OpenSSL Step By Step Tutorial | How to Generate Keys, Certificates & CSR Using OpenSSL
Вставка
- Опубліковано 18 жов 2024
- OpenSSL step by step tutorial explaining how to generate key pair, how to export public key using openssl commands, how to create CSR using openSSL and how to generate self signed certificate using Open SSL command line tool.
To dowload openSSL visit: www.openssl.org/
To learn how to use Java Key Tool to generate self signed certificates: • How to Generate Key St...
To learn how to use Portecle to generate self signed certificates: • Generate Self Signed C...
To learn difference between one-way and two-way SSL: • How One Way and Two Wa...
Hi Sir, what you said was awesome and great informative and I'll suggest few and give knowledge on this sir ❤🙏
Excellent video Sir. Thank you; it is greatly appreciated.
I needed someone to explain it like this for so long. Thank you man.
Very well demonstrated key-pair generation, extracting public key, CSR and self-signed certificate. Great work!
Lot's of CSR videos but this one was perfect! Thank you!
wow everything worked so flawlessly, you're a hero
Good job done. Very clearly explained and everything was right to the point and it held my attention. Everyone should do their training videos like this.
It cleared all my doubts..nicely explained..thanks for the amazing video..!
Great Video, Very clearly explained about CA, CSR.
I have a question:
When we are opening the //https connection using self signed CA certificate getting some warnings on //https web page. May I know the reason?
Kindly, respond.
Thanks
Dear Ankur,
Thanks for the kind feedback.
In case of a self-signed certificate, we get SSL warning because chain of trust is not identified by the browser. Browser trusts only CA signed certificates (unless you explicitly add your certificate in the trust store).
I will recommend you to watch my other video where I explained SSL chain of trust in much detail.
Excellent demonstration sir. Thank you for making this clear to me.
BRAVO! thank you for the clear and practical explanation!
Thanks a lot bro..I was looking for a simple but explanatory tutorial on how certificates work..this video helped me to understand a lot
JazakAllah Abdul Rauf. Glad that It helped.
Short video, simple to understand. WOW!!! Thank you
Great video, but you now have weird files on your computer. What do you do with these weird files. Do I ftp to my server, control panel, do I need to go to ican or other ssl org to upload them?
Great video ... I was confused before watching this, now I understand much better. Thanks.
how to creat command "CLS" clear screen in this toolkit , or same equivalent???????????????????????
Hi sir,
I want to configure certificate based authentication, it requirement
1.CA,
2.User Certificate,
3.server certificate.
What should I do, whether is same with you do?
Thanks a lot .Love from India
Just created my first key, ever. Now going to implement this....
Nice video in detail. I have one question in terms of renewal. To renew the existing CA signed certificate, is it correct to give old CSR (CSR generated to get CA signed initially). Is there any validity for key pair and CSR generated?
Thanks for the great tutorials. How I securely push these key (private & cer) in jks file ?
Can you tell me how we can extract the private key from the key pair, as well as the public key?
Awesome. This is what I needed this morning.
Clear explanation to the point. Thanks buddy. Keep uploading more videos like this.
Hisir.
How do one vedio on how to create csr repo
Worked for me, best video on openssl
Good explanation in detail. I have one query in terms of renewal. To renew the existing CA signed certificate, is it correct to give old CSR (CSR generated to get CA signed initially). Is there any validity for key pair and CSR generated?
Great video.. all commands worked for me...thanks...one query how to add critical extensions using your commands?
Awesome explanation bro !!!
Very useful - clear and consise. Thanks for sharing.
JazakAllah. Thanks
Thankyou. Video was very clear
all those who are having error like me
The only thing that worked for me in this situation was the self-created openssl.cnf file.
Here are the basics needed for this exercise (edit as needed):
#
# OpenSSL configuration file.
#
# Establish working directory.
@/c:\Users\User\Desktop\test
dir = .
[ ca ]
default_ca = CA_default
[ CA_default ]
serial = $dir/serial
database = $dir/certindex.txt
new_certs_dir = $dir/certs
certificate = $dir/cacert.pem
private_key = $dir/private/cakey.pem
default_days = 365
default_md = md5
preserve = no
email_in_dn = no
nameopt = default_ca
certopt = default_ca
policy = policy_match
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ req ]
default_bits = 1024 # Size of keys
default_keyfile = key.pem # name of generated keys
default_md = md5 # message digest algorithm
string_mask = nombstr # permitted characters
distinguished_name = req_distinguished_name
req_extensions = v3_req
[ req_distinguished_name ]
# Variable name Prompt string
#------------------------- ----------------------------------
0.organizationName = Organization Name (company)
organizationalUnitName = Organizational Unit Name (department, division)
emailAddress = Email Address
emailAddress_max = 40
localityName = Locality Name (city, district)
stateOrProvinceName = State or Province Name (full name)
countryName = Country Name (2 letter code)
countryName_min = 2
countryName_max = 2
commonName = Common Name (hostname, IP, or your name)
commonName_max = 64
# Default values for the above, for consistency and less typing.
# Variable name Value
#------------------------ ------------------------------
0.organizationName_default = My Company
localityName_default = My Town
stateOrProvinceName_default = State or Providence
countryName_default = US
[ v3_ca ]
basicConstraints = CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
[ v3_req ]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
# copy till here
now save this file and run the command as
openssl req -new -key tutorialspedia.key -out tutorialspedia.csr -config openssl.cnf
hope this will work for you :)
Thank you very much. Was thinking I will never get it with this csr.
Thanks from Poland!👍
Thanks for the clear explanation
excellent video. thank you.
CAn you create an video about self signing code signing certificate
Hello when i use command for create csr file. This file is not shown when type dir command
it is not created. Why this issue happened ?
Very nice job.
Please add info on how to create "non-self-signed certificates". Meaning certificate verifying some other public key. Thanks
In this case can we generate public keys and match with public keys being used by differenrt companies?
Thanks a lot for the precise, and informative video.
Good explanation , keep it up
Good job clearly explained
Thank you, really helped me!
how can we stop the stdin for step 3 like country name etc, and provide through argparser ?
Command to create self signed certificate with csr and private key is not working shows x509: Use -help for summary. any idea?
Very nice video. Thank you very much. How to create certificate with encryption and does the server also should have a certificate with encrypted key? And also can we use Portecle to generate certificates with encrypted key for linux?
Well done for this nice video
thanks bro, you are the best
Thanks - I had all this confused. You helped a lot. Now how do I get this into Windows 10?
Thanks Dave for your feedback. You can download windows version of openssl and use it in your machine. I myself created this tutorial in Windows 10.
I also had a problem with installing it on windows but then I found this tutorial helpful
ua-cam.com/video/YNKUpNpM0Q0/v-deo.html&ab_channel=TechDeepDiveTechDeepDive
really great way of teaching thanks.
Thanks for your feedback Vivek.
Awesome 😍
Great job!
Awesome explanation. Thank you!
Thank you!
If I want to create SSL certificates on cluster having 4-5 nodes, can we have same crt copied to all hosts?
Thank you very much, very clear and to the point!
Can you also make a video on certificate chaining / Intermediate CAS
6:00 Why did you pass the initial key file? .. shouldnt we pass the public key file?
superb knowledge ... my friend .. keep sharing it..
Great Tutorial, Thanks
Thank you bro!!
you are save my life!!
Thanks a lot!!! Exactly what I was looking for
Job saving info for me.
Good job mate :) PK/ISB at last someone from PK
So happy to see that. Subbed him.
wow..
It helped me a lot
Hi, how can get my Certicate Signed by 'CA' instead of Self-Signed?
Hi Vipul,
Once you have created CSR, in order to get it signed by a CA, you need to share your CSR with a CA for the subsequent steps.
@@TutorialsPediaVideos thanks, is there a free CA that you know?
I Like it.
Thank you
very helpful. thank you
awsome!!!!!!
Very informative 😊👏
executing openssl command to generate key pair using "openssl genrsa -out keyfile.key 2048" but facing an error "genrsa: Can't open "keyfile.key" for writing, Permission denied". Could you guide me hot to fix this
Run the cmd as an administrator
Its asking me - Enter pass phrase for domain. What is the pass phrase??
Good job! Thank you!
The video is good but you have a major mistake. I think the video is using the entire key pair file instead of the public key to generate the CSR which in turn will go to the CA. This is a very important piece of information that will kill you in any test or interview. The steps are correct but the files being used are wrong. The CSR should be created only with the public key file, the CA will generate a certificate. After verification, the CA sends you a signed digital certificate that contains your distinguished name, your public key, the CA's distinguished name, and the signature of the certificate authority. You store this signed certificate in your key database.
Are you serious ? "CSRs are signed using the private key to prevent tampering in transit to the CA.
@@LeXT89 That’s correct. The private key file, which also contains the public key information, is used to sign the CSR. The CSR does not contain the private key. It isn't necessary to extract the public key to create a CSR. OpenSSL supports the creation of the CSR directly from the private key file.
thank you bhai
this is just perfect, simple, effective !
Great presentation - thanks
Thanks for your kind feedback Mark.
Thanks, Its really helpful.
You are welcome Ruchi.
Can I deploy certificate on godaddy domain?
info given in this video was insufficient to running localhost with https using openssl certificate. It ended with net::cert_common_name_invalid error in chrome on windows and also with hhtps strickedout in url with no green lock in browser address bar. I appreciate further help to fix the error...
Thank you So Much Sir
good video, very nicely explained. thanks
I am getting Can't open -testauto.key for reading, No such file or directory error any idea ?? followed the same steps
same error bro
@@ashishsulakhe3894 same here
thank you very much, it was very useful
wow thank you explained so clearly
How should I verify that same csr for the crt that was created
How to solve the invalid digest for sha1 error while creating csr
great tutorial, thank you!
Thanks for your feedback Enrique.
i am getting an error saying warning can't open config file: C:/OpenSSL/openssl.cnf please do help
3:25 you have not generated key PAIR right? You have just created the private key. Where is the public key?
hi bro, can you check my error''Unable to load config info from /usr/local/ssl/openssl.cnf''
Try to run as administrator.
5:40 WHY DO I have to provide my *Private key* to the *CA Authority* for CSR , This seems to be wrong to me. Please explain.
I believe you misunderstood the point. I explained in the video that CSR is shared with the CA.
only for creation of the csr file the private key is needed. in the csr file itself only the public key is contained.
en.wikipedia.org/wiki/Certificate_signing_request
@@TutorialsPediaVideos I see in the command you used to generate cert, you used private key... is the public key need to be given? please clarify
@@subhakardondapati8340 you are correct. i think the video is using the entire key pair file instead of the public key to generate the CSR which in turn will go to the CA. This is a very important piece of information that will kill you in any test or interview.
thanks for your help bro
You are welcome Roberto.
It's very helpful~!
Glad to hear that it helped.
where do we need self signed certificate in real world scenario...
What is the command to connect for godaddy signed ssl
how can i remove or rekove the same certificate ??
Nice explanation ! Thank you !
Thanks Jimmy. Glad that it was helpful.