0

I am trying to secure both naked and www domain ( https://example.com and https://www.example.com ) with positivessl

  1. For this Server cmd would be

    openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr

or it would be something else ?

  1. To secure both naked and www domain when server ask for Common Name: What should we put ? example.com or *example.com

Server is Ubuntu 18.04 and Ngnix + Apache Thanks

  • 1
    use the wildcard approach and increase your key size openssl req -new -newkey rsa:4096 -nodes -out star_friendscom.csr -keyout star_friends.com.key -subj "/C=GH/ST=Greater-Accra/L=Accra/O=Friends LTD./CN=*.friends.com" – saviour123 Mar 27 at 15:29
0

You are close: use the wildcard approach and increase your key size

openssl req -new -newkey rsa:4096 -nodes -out star_friends.com.csr -keyout star_friends.com.key -subj "/C=GH/ST=Greater-Accra/L=Accra/O=Friends LTD./CN=*.friends.com"
  • The subject of a certificate should be in the Subject Alternative Name extension these days, not in (or in addition to) the Subject field. A certificate generated with this would cause Chrome and Firefox to complain. – garethTheRed Mar 27 at 15:54
  • @saviour123 Thanks for answer i run command after command it show nothing on screen how can i access the Both Csr and private file – Veer Vaar Mar 27 at 16:07
  • they are located in location where you run the command, like outputs – saviour123 Mar 27 at 16:50
0

Create a file with the following (modified to suit your names) and save it as (for example) example.cnf in your chosen directory:

[ req ]

prompt             = no
string_mask        = default

# The size of the keys in bits:
default_bits       = 2048
distinguished_name = req_dn
req_extensions     = req_ext

[ req_dn ]

# Note that the following are in 'reverse order' to what you'd expect to see in
# Windows and the numbering is irrelevant as long as each line's number differs.

# Domain Components style:
# Server name:
# 2.DC = com
# 1.DC = example
# commonName = Acme Web Server

# Locality style:
# countryName = GB
# stateOrProvinceName = London
# localityName = Letsby Avenue
# organizationName = Acme
# 1.organizationalUnitName = IT Dept
# 2.organizationalUnitName = Web Services
# commonName = Acme Web Server

# Or traditional org style:
countryName = GB
organizationName = Acme
1.organizationalUnitName = IT Dept
2.organizationalUnitName = Web Services
commonName = Acme Web Server
# Or:    
# commonName = www.example.com

[ req_ext ]

subjectAltName = @alt_names

[alt_names]
# To automatically copy the CN (in the case of a DNS name in the CN) use:
# DNS.1 = ${req_dn::commonName}
DNS.1 = www.example.com
DNS.2 = example.com

Run the following to create your CSR:

openssl req -nodes -new -keyout example.key -out example.csr -config example.cnf

Note that this leaves the private key in plain-text on your system. Depending on what service you're using this key with, you might want to consider password protecting it by removing the -nodes verb from the command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.