Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to understand the proper flow for installing SSL on a server (rather a couple of servers behind an AWS load-balancer). offers up a wizard. I want to confirm that I can enter the details, run the openssl command and receive two things:

domain.csr domain.key

I then use the csr to actually purchase the certificate, and use the key for signing. Is this correct? Am I missing a piece of the puzzle?

share|improve this question
up vote 7 down vote accepted

CSR stands for Certificate Signing Request, and you've pretty much got it.

The CSR is just for throwing at the Certificate Authority; it contains your public certificate, but not in a form that's useful for anything other than sending to get it signed.

They'll sign it and send back your public certificate file, which will be .pem or .crt. That will be the public certificate sent out to each client system that requests a page. It will contain the info you've defined in that page (CN and organization details) as well as the stuff that they add from the CA (where clients can get the parent cert, certificate revocation list locations, allowed usages of the certificate, etc).

The .key is the private key for the certificate, in its final form. You'll feed that to the web server as the private key, and it's used for decryption of data sent in by clients, encryption of data sent to clients, and signing of data for authentication.

share|improve this answer
wicked dude. thanks. – onassar Apr 8 '11 at 15:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.