Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a root certificate (root.cer) that's not signed by a CA, but is trusted on all computers on our internal network & I need to create a csr against it for my local apache webserver that serves a small intranet site. I'm not sure I'm phrasing it right, but I'm hoping somebody will recognize what I mean. How can I do this?

share|improve this question
up vote 3 down vote accepted

You don't use a root certificate to generate a CSR. You use the root certificate and the CSR to create a signed certificate.

What you need to do is to generate your CSR as if you were buying a third-party SSL certificate, and then sign it yourself instead. Assuming you're on a Unix box and have openssl installed, you then do:

openssl x509 -req -days <desired certificate life in days> \
-in <path/to/CSR> -signkey </path/to/privaterootcert> \
-out </path/to/signedcertificate>
share|improve this answer
I knew I had it backwards. Thanks! – churnd Jan 26 '11 at 19:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.