Generate csr against root certificate

Question

I have a root certificate (root.cer) that's not signed by a CA, but is trusted on all computers on our internal network & I need to create a csr against it for my local apache webserver that serves a small intranet site. I'm not sure I'm phrasing it right, but I'm hoping somebody will recognize what I mean. How can I do this?

Answer 1

You don't use a root certificate to generate a CSR. You use the root certificate and the CSR to create a signed certificate.

What you need to do is to generate your CSR as if you were buying a third-party SSL certificate, and then sign it yourself instead. Assuming you're on a Unix box and have openssl installed, you then do:

openssl x509 -req -days <desired certificate life in days> \
-in <path/to/CSR> -signkey </path/to/privaterootcert> \
-out </path/to/signedcertificate>