Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently got a mail from my hosting server that the SSL certificate for one of my Wordpress website is about to expire in 5 days.

It says the certificate needs to be renewed; this can be done using the 'genkey' program. I'm not sure how to do that. I didn't use self-signed certificate rather bought from GeoTrust Inc.

They do have a renew option but I'm not sure how to use that in my server. How can I make use of 'genkey' program? I'm using RHEL 5 OS.

share|improve this question

migrated from Jan 29 '12 at 18:55

This question came from our site for professional and enthusiast programmers.

up vote 3 down vote accepted

You need to generate a Certificate Signing Request (CSR) and submit it to GeoTrust. They will sign the CSR and give you a certificate. This certificate will be associated with a private key that will be created when you generate the CSR. Your web server will require both the cert and the private key to function.

Here are some docs on certificates:

That's using openssl, which you should already have installed on CentOS5.

Note that the command they give is a bit outdated; certificate signing authorities like GeoTrust are now requiring 2048-bit keys. So, your command will be:

$ openssl req -new -key privkey.pem -out cert.csr -newkey rsa:2048

You can change the names of cert.csr (which is the CSR) and privkey.pem (which is the private key) to something more appropriate, e.g., and

The important part of the CSR will be the Subject of the signing request. This should match the name of the web site (e.g., or be a wildcard (* Make sure this matches correctly or your site will generate SSL warnings.

GeoTrust should have more instructions on what they require for CSRs. Note that the resulting CSR is a text file; I imagine you will copy-and-past the contents of the file into some form at the certificate signing authority.

When you install the certificate and key, there will likely also be a intermediate certificate authority bundle provided by GeoTrust. As said, GeoTrust will have instructions on how to arrange these files for most common web servers.

share|improve this answer
Thank you for the easy explanation. – harithahv Jan 30 '12 at 6:52
Note that the CSR is mostly used by the CA to extract a public key. The rest of the information tends to be there as an indication for them: they'll replace any attribute and RDN in the Subject DN as they wish (as they should indeed do, since they're the certificate issuer). Whether your get the name right in the CSR shouldn't matter too much, but you must get the host name right in whatever forms you fill when doing the application. – Bruno Jan 30 '12 at 9:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.