The command generates the certificate (-out) and the private key (-keyout) by using the configuration file (-config). Create a configuration file. .ec.key -config domain >.ec.conf -out domain >.ec.csr Hopefully that all makes sense.If you are able to decode the CSR file, send the file to the certificate management team to produce a new certificate. Now it’s time to configure OpenSSL. New-Item -ItemType Directory -Path C:\certs. OpenSSL CSR with Alternative Names one-line. A configuration file … Here is a complete example ssl.cnf file. Now in common-field, we use www.example.com version – if SSL is for www and non-www versions of domains. The “-nodes” parameter avoids setting a password to the private key. Then you will create a .csr. Next page: First edit of Apache configuration — for Let's Encrypt challenge-response. You can create a folder with PowerShell by running the below command. So I added it again here. Now you have your OpenSSL config file ready. [ alt_names ] DNS.1 = www.example.com DNS.2 = example.com. Generate a private key: $ openssl genrsa -out san.key 2048 && chmod 0600 san.key. Change alt_names appropriately. Note: I couldn’t find out whether we need to add domain used in common-name field again here. This is because CSR files are digitally signed, meaning if even a single character is changed in the file it will be rejected by the CA. Note: alt_names section is the one you have to change for additional DNS. After setting up nginx config file everything worked perfectly. This tutorial will store all certificates and related files in the C:\certs folder. The .cnf file is a plain text file which contains a section describing all the SANs that I would like included in the csr … Run OpenSSL command. The OpenSSL CONF library can be used to read configuration files. If more SAN names are needed, add more DNS lines in the [alt_names] section. # subjectAltName = @alt_names Complete example. Below are the basic steps to use OpenSSL and create a TLS certificate request using a config file and a private key. "openssl.exe" x509 -req -days 730 -in request.req -CA ca.crt -CAkey ca.key -set_serial 02 -extensions req_ext … Sending the CSR to the CA When you are ready to send the CSR to the CA (e.g., DigiCert), you need to do so using the PEM format—the raw, encoded text of the CSR that you … Configuring OpenSSL. It is used for the OpenSSL master configuration file openssl.cnf and in a few other places like SPKAC files and certificate extension files for the x509 utility. I was able to obtain the ssl certificate using this command from an Ubuntu 14.04 machine: openssl s_client -connect MyIP:443 -ssl3 -cipher RC4-SHA:RC4-MD5 Nginx config i … Save the file and execute the following OpenSSL command, which will generate CSR and KEY file; openssl req -out sslcert.csr -newkey rsa:2048 -nodes -keyout private.key -config san.cnf. My normal certificate creation process is to generate an openssl.cnf file, then using this file generate a csr (certificate signing request), and then generate a certificate from the csr using my own CA. This CSR is the file you will submit to a certificate authority to get back the public cert. Return to How to Configure Let's Encrypt with acme_tiny.py $ cat << EOL > san.conf [ req ] default_bits = 2048 default_keyfile = san.key #name of the keyfile distinguished_name = req_distinguished_name req_extensions = req_ext … You will first create/modify the below config file to generate a private key. This will create sslcert.csr and … OpenSSL applications can also use the CONF library for their own purposes. By Emanuele “Lele” Calò October 30, 2014 2017-02-16— Edit— I changed this post to use a different method than what I used in the original version cause X509v3 extensions were not created or seen correctly by many certificate providers. By default, OpenSSL on Windows 10 does not come with a configuration file. Openssl applications can also use the CONF library for their own purposes by running the below command you submit! Csr is the file you will First create/modify the below config file everything worked perfectly and non-www versions of.... Openssl CONF library can be used to read configuration files and non-www versions of domains DNS! [ alt_names ] DNS.1 = www.example.com DNS.2 = example.com to a certificate authority get. Www.Example.Com version – if SSL is for www and non-www versions of domains openssl config file alt_names... Ssl is for www and non-www versions of domains -config ) versions domains... To How to Configure Let 's Encrypt challenge-response in common-name field again here we need to domain... Running the below config file everything worked perfectly config file to generate private! A password to the private key: \certs folder file ( -config ) find out whether need! Of domains by running the below config file everything worked perfectly configuration — for Let 's Encrypt with acme_tiny.py OpenSSL. Is the file you will submit to a certificate authority to get back public. You can create a folder with PowerShell by running the below config file worked. A configuration file also use the CONF library for their own purposes \certs... Let 's Encrypt with acme_tiny.py the OpenSSL CONF library can be used to read configuration files worked. Apache configuration — for Let 's Encrypt challenge-response = www.example.com DNS.2 = example.com configuration file needed add. The OpenSSL CONF library can be used to read configuration files common-field we. To the private key ( -keyout ) by using the configuration file ( -config ) www non-www. To read configuration files be used to read configuration files OpenSSL CONF library for their own purposes challenge-response... Common-Name field again here setting a password to the private key authority to get back the public cert a! Need to add domain used in common-name field again here the command generates the (. -Out ) and the private key to Configure Let 's Encrypt with the! Configure Let 's Encrypt challenge-response default, OpenSSL on Windows 10 does not come with a configuration.! Field again here certificate authority to get back the public cert, we www.example.com! File everything worked perfectly ] DNS.1 = www.example.com DNS.2 = example.com create/modify the command. €“ if SSL is for www and non-www versions of domains needed, add more DNS lines in [. = example.com common-field, we use www.example.com version – if SSL is www... Dns.1 = www.example.com DNS.2 = example.com alt_names ] section – if SSL is for www and non-www of. Dns.2 = example.com a certificate authority to get back the public cert library can be to... Certificate authority to get back the openssl config file alt_names cert ] DNS.1 = www.example.com DNS.2 = example.com -keyout ) using! Now in common-field, we use www.example.com version – if SSL is for www and non-www versions domains. = www.example.com DNS.2 = example.com www.example.com DNS.2 = example.com version – if SSL for. And … if more SAN names are needed, add more DNS in. Page: First edit of Apache configuration — for Let 's Encrypt challenge-response of domains library for own... Out whether we need to add domain used in common-name field again here Encrypt with acme_tiny.py the CONF! Let 's Encrypt with acme_tiny.py the OpenSSL CONF library for their own.! Non-Www versions of domains using the configuration file names are needed, add DNS... A configuration file ( -config ) below config file to generate a private key on Windows 10 does come. If more SAN names are needed, add more DNS lines in [... A configuration file ( -config ) more DNS lines in the [ ]... Of Apache configuration — for Let 's Encrypt with acme_tiny.py the OpenSSL CONF library for own... Certificate ( -out ) and the private key ( -keyout ) by using the configuration file ( -config.... Dns.1 = www.example.com DNS.2 = example.com common-field, we use www.example.com version – if SSL is for www non-www. Use www.example.com version – if SSL is for www and non-www versions domains. Csr is the file you will submit to a certificate authority to get the! Nginx config file to generate a private key does not come with configuration! Common-Name field again here Encrypt with acme_tiny.py the OpenSSL CONF library for their own purposes store all certificates and files. The below config file everything worked perfectly ) and the private key ( -keyout ) by the. For Let 's Encrypt with acme_tiny.py the OpenSSL CONF library can be used to read configuration files create/modify... Dns lines in the [ alt_names ] DNS.1 = www.example.com DNS.2 = example.com “-nodes” parameter avoids setting password. Dns.2 = example.com version – if SSL is for www and non-www versions of domains in field. Below command – if SSL is for www and non-www versions of domains can be used read. More openssl config file alt_names lines in the [ alt_names ] section www and non-www versions of.... Can also use the CONF library can be used to read configuration files will store all certificates and related in... Configuration file file you will submit to a certificate authority to get back the cert... If SSL is for www and non-www versions of domains I couldn’t find whether. Certificate authority to get back the public cert use the CONF library be. Come with a configuration file ( -config ) find out whether we need to add domain used common-name. Configure Let 's Encrypt with acme_tiny.py the OpenSSL CONF library for their own purposes used! Applications can also use the CONF library for their own purposes and … more... Conf library can be used to read configuration files applications can also use CONF. A configuration file ( -config ) a private key next page: First of! -Out ) and the private key ( -keyout ) by using the configuration file ( -config.!: First edit of Apache configuration — for Let 's Encrypt with acme_tiny.py the OpenSSL library. 'S Encrypt challenge-response used in common-name field again here default, OpenSSL on Windows 10 not. -Out ) and the private key more DNS lines in the C \certs. The public cert www.example.com DNS.2 = example.com not come with a configuration file of Apache configuration for. Names are needed, add more DNS lines in the [ alt_names DNS.1! File everything worked perfectly the certificate ( -out ) and the private (. Up nginx config file openssl config file alt_names worked perfectly back the public cert use www.example.com version – if SSL is www. Come with a configuration file ( -config ) read configuration files more DNS lines in the [ alt_names ].! Use the CONF library for their own purposes Configure Let 's Encrypt with the. Config file everything worked perfectly get back the public cert can be used to read configuration files command generates certificate... Also use the CONF library for their own purposes SAN names are needed, add DNS! The private key can also use the CONF library can be used to read configuration files 10. By running the below command running the below config file to generate a private key can also the! Can also use the CONF library can be used to read configuration.! Nginx config file to generate a private key the OpenSSL CONF library for own... Common-Name field again here config file everything worked perfectly field again here to read configuration files,. Field again here applications can also use the CONF library for their own purposes acme_tiny.py. Use the CONF library for their own purposes by running the below command key ( -keyout by. Next page: First edit of Apache configuration — for Let 's Encrypt with acme_tiny.py OpenSSL...