Now I have these files:

CA Keypair (RSA 4096):

ca.pem, ca-key.pem

Certificate Keypair (ECC 384):

server.csr, server-key.pem

How can I issue the server certificate "server.pem"?

The certificate chain should look like this:

Example CA



openssl x509 will sign the certificate for you:

openssl x509 -req -set_serial 1234 -in server.csr -CA ca.pem -CAkey ca-key.pem -out server.pem

However, it's very unlikely that it will produce exactly what you're expecting. Have a read of the man page for all the details. For example, you may want to add specific extensions to the certificate, such as a SAN. In such cases, you need to create a file containing the extension, as follows:

[ san_ext ]

subjectAltName = @alt_names

DNS.1 = www.example.com
DNS.2 = example.com

The save it (e.g. as san.cnf). Finally, tell OpenSSL about it with the -extfile and the -extensions options:

openssl x509 -req -set_serial 1234 -ext file san.cnf -extensions san_ext -in server.csr -CA ca.pem -CAkey ca-key.pem -out server.pem
  • Yes, the certificate is now issued, but missing SAN. How to add it, then? – Elepover Hedop Dec 6 '18 at 8:48

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.