How to generate a CSR for Apache using OpenSSL

Updated on 28 Oct 2024

The instructions below walk you through generating a CSR on Apache with OpenSSL. For more on CSRs and why your private key matters, see our Certificate Signing Request overview. If you have already generated the CSR and received your trusted SSL certificate, see our SSL installation instructions and skip the steps below.

1. Log in

Log in to your server's terminal over Secure Shell (SSH).

2. Run the CSR generation command

Generate a private key and a CSR by running the following. Here it is as plain text, ready to copy into your terminal:

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

Note: replace "server" with the domain name you want to protect.

3. Enter your details

Enter the following CSR details when prompted:

  1. Common Name: the fully qualified domain name you want the certificate to protect, such as www.google.com, secure.website.org or *.domain.net.
  2. Organisation: the full legal name of your organisation, including any corporate identifier.
  3. Organisational Unit (OU): your department, such as "Information Technology" or "Website Security".
  4. City or Locality: the town or city where your organisation is legally registered. Do not abbreviate.
  5. State or Province: the state or province where your organisation is legally registered. Do not abbreviate.
  6. Country: the official two-letter country code (US, CH) where your organisation is legally registered.

Note: you do not need to enter a password or passphrase. That optional field applies extra security to your key pair.

4. Copy the CSR text out of the file

Find the CSR you just created, open it in a plain text editor such as Notepad and copy all of the text, including:

-----BEGIN CERTIFICATE REQUEST-----
And
-----END CERTIFICATE REQUEST-----

Note 1: your CSR is saved in the same user directory you are SSHed into, unless you say otherwise. Note 2: keep a copy of the ".key" file you just generated — you will need it later, during installation.

5. Generate the order

Go back to the generation form on our website, paste the whole CSR into the empty text box and carry on through the generation process.

Once you generate your CSR, your order enters validation with the issuing certificate authority, which will ask whoever requested the certificate to complete some form of validation depending on the certificate purchased. For the different levels of validation and how to satisfy the industry requirements, see our validation articles.

After validation is complete and the certificate authority has issued your trusted SSL certificate, carry on with our SSL installation instructions.