Release Notes
Security Announcement
Announcements
4096 key length as an example, and save the generated private key as a ca-rsa.key file.openssl genrsa -out ca-rsa.key 4096
ca-rsa.csr. The following command specifies the basic information of the certificate through -subj, where:openssl req -new -key ca-rsa.key -out ca-rsa.csr -subj "/C=US/ST=State/L=City/O=Example Org/OU=Example CA/CN=Example Root CA"
ca-rsa.crt. The -extfile parameter specifies this certificate as a CA certificate.openssl x509 -req -in ca-rsa.csr -out ca-rsa.crt -signkey ca-rsa.key -days 3650 -sha256 -extfile <(printf "basicConstraints=critical,CA:TRUE\\nkeyUsage=critical,keyCertSign,cRLSign\\nsubjectKeyIdentifier=hash\\n")
openssl x509 -in ca-rsa.crt -noout -text | grep -A2 "X509v3 Basic Constraints"
CA:TRUE, which indicates a correct CA certificate. See the output result below:X509v3 Basic Constraints: criticalCA:TRUE # Indicates the cert is a CA certificate.X509v3 Key Usage: critical
www.example.com, you can use the generated CA certificate to start issuing a self-signed domain name certificate:4096 key length as an example, and save the generated private key as a rsa-domain.key file.openssl ecparam -name secp384r1 -genkey -noout -out rsa-domain.key
rsa-domain.csr. The following command specifies the basic information of the certificate through -subj. Please note to replace the CN field content with the domain name you want to issue. In this example, www.example.com is used.openssl req -new -key rsa-domain.key -out rsa-domain.csr -subj "/C=US/ST=State/L=City/O=Example Org/OU=Example CA/CN=www.example.com"
rsa-domain.crt.openssl x509 -req -in rsa-domain.csr -out rsa-domain.crt -CA ca-rsa.crt -CAkey ca-rsa.key -days 3650
openssl verify -CAfile ca-rsa.crt rsa-domain.crt
rsa-domain.crt:OK, it indicates that the certificate issuance chain is correct. See the following:rsa-domain.crt: OK
secp384r1 encryption algorithm as an example, and save the generated private key as a ca-ecc.key file.openssl ecparam -name secp384r1 -genkey -noout -out ca-ecc.key
ca-ecc.csr. The following command specifies the basic information of the certificate through -subj, where:openssl req -new -key ca-ecc.key -out ca-ecc.csr -subj "/C=US/ST=State/L=City/O=Example Org/OU=Example CA/CN=Example Root CA"
ca-ecc.crt. The -extfile parameter specifies this certificate as a CA certificate.openssl x509 -req -in ca-ecc.csr -out ca-ecc.crt -signkey ca-ecc.key -days 3650 -sha256 -extfile <(printf "basicConstraints=critical,CA:TRUE\\nkeyUsage=critical,keyCertSign,cRLSign\\nsubjectKeyIdentifier=hash\\n")
openssl x509 -in ca-ecc.crt -noout -text | grep -A2 "X509v3 Basic Constraints"
CA:TRUE, which indicates a correct CA certificate. See the output result below:X509v3 Basic Constraints: criticalCA:TRUE # Indicates the cert is a CA certificate.X509v3 Key Usage: critical
www.example.com, you can use the generated CA certificate to start issuing a self-signed domain name certificate:secp384r1 encryption algorithm as an example, and save the generated private key as a ecc-domain.key file.openssl ecparam -name secp384r1 -genkey -noout -out ecc-domain.key
ecc-domain.csr. The following command specifies the basic information of the certificate through -subj. Please note to replace the CN field content with the domain name you want to issue, using www.example.com as an example in this case.openssl req -new -key ecc-domain.key -out ecc-domain.csr -subj "/C=US/ST=State/L=City/O=Example Org/OU=Example CA/CN=www.example.com"
ecc-domain.crt.openssl x509 -req -in ecc-domain.csr -out ecc-domain.crt -CA ca-ecc.crt -CAkey ca-ecc.key -days 3650
openssl verify -CAfile ca-ecc.crt ecc-domain.crt
ecc-domain.crt:OK, it indicates that the certificate issuance chain is correct.ecc-domain.crt: OK
Was this page helpful?
You can also Contact sales or Submit a Ticket for help.
Help us improve! Rate your documentation experience in 5 mins.
Feedback