Tag Archives: ssl certficate

Creating self-signed certificates with makecert

If you are even in a bind and need a quick self-signed SSL cert and have the Windows SDK installed on your machine, there's a chance you may have the makecert utility and can generate a quick self-signed SSL cert.

The command is as follows:

makecert -r -pe -n "CN=SelfSigned SSL" -a sha1 -ss My -len 2048 -sy 24 -b 01/01/2015 -e 01/01/2050

A complete list of each of the switches can be found here:
https://msdn.microsoft.com/library/windows/desktop/aa386968.aspx

Additionally, a nice MSDN article has been posted on this subject as well: https://msdn.microsoft.com/en-us/library/ff699202.aspx

MakeCert is available as part of the Windows SDK, which you can download from http://go.microsoft.com/fwlink/p/?linkid=84091

Generating a SSL Cert with Apache & openSSL

Registering a SSL cert is always kind of a mystery for me. You always have to use a crazy long command line command and the wizard always asks funky questions. Hopefully this tutorial will help clarify the process.

First run the following command:

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

And what the command does is it is generating a 256bit SSL certificate. RSA:1024 would generate a 128bit certificate. When the process has finished, you will have yourdomain.key and yourdomain.csr. yourdomain.key should NOT be distributed. This is your key to decrypt your traffic. The CSR should be presented to your CA (certificate authority).

As far as the generation process goes, you will be presented with a few questions:
Country: The two-letter International Organization for Standardization (ISO) format country code for where your organization is legally registered. This would be US for the United States.
State or Province: Name of the state or province where your organization is located. Write out the name in full.
City or Locality: Name of the city where your organization is registered/located. Write out the name in full.
Organization Unit: This may be left blank. However, if you are a company, you may want to put your company nickname here. I.e. Vooba instead of Vooba LLC
Organization: Vooba LLC
Passphrase: Depending on your registrar, you can/can't use this. If you can't use it, I recommend finding a different company. Use a strong password here.
Common Name: The fully-qualified domain name (FQDN), or URL, you want to secure. If you are not using a wild-card domain (*.yourdomain.com), use www.yourdomain.com. This will allow www.yourdomain.com and yourdomain.com to be secured. If you only secure yourdomain.com, www.yourdomain.com will be invalid.

Hope this helps and clarifies the process!