SSL certificate - external

1. Generate Private key

openssl genrsa -out san_domain.com.key 2048

?not protected - no passphrase?

2. Create the CSR file

1. Provide details on prompt

1. openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

2. Provide details file <openssl.cnf>

1. openssl req -new -out san_domain.com.csr -key san_domain.com.key -config openssl.cnf

If prompt=yes.

Value (from key=value) is taken as title for that key at the prompt.

DefaultValue is used.

openssl req -new -newkey rsa:2048 -nodes -out <Sub-domain>_<Domain>.<TLD>.csr -keyout <Sub-domain>_<Domain>.<TLD>.key -subj "/C=<Country_Code>/ST=<State>/L=<City>/O=<Organization>/CN=<Sub-domain>_<Domain>_<TLD>"

The output content of CSR file can be verified using

openssl req -text -noout -in <file.csr>

1. Send CSR > Authenticate > Obtain cert chain files.

1. Generate bundle file by concatenating the CA files.

5. Create certificate file

openssl pkcs12 -export -in Sub.Domain.TLD.crt -inkey Sub.Domain.TLD.key -out Sub.Domain.TLD.p12 -name tomcat -CAfile Sub.Domain.TLD.ca-bundle -caname root -chain

SAN - Subject Alternative Names.