Creating SSL Certificates

Needed to do a bit of searching on the exact steps to create a ".cer" certificate. The default ssl-keygen will generate public and private keys, but this isn't enough for some applications. Some need a signed X509 certificate, which involves a couple extra steps. Note, because the certificate will not be signed by a trusted certificate authority, your browser/application may throw a fit and complain the certificate has errors. If that's the case, you can purchase an actual certificate from Verisign (very expen$ive) or from GoDaddy or some other lesser priced Certificate Authority your computer trusts. (Note, you could become your own certificate authority if you have complete control over the machines using your certificate. In which case, you can sign your own certificates and the browsers/apps will never complain).

Okay - let's get started. The following steps worked for me, and since I'll forget them, I've written them down as I'll likely need them again in the future.

First, run the ssh-keygen tool. 

cachedmemory>ssh-keygen

Generating public/private rsa key pair.

Enter file in which to save the key (/home/cachedmemory/.ssh/id_rsa):

(Press Enter to accept the default location)

Enter passphrase (empty for no passphrase):

(Enter a passphrase if you like - it's more secure if you do)

Enter same passphrase again:

Your identification has been saved in /home/cachedmemory/.ssh/id_rsa.

Your public key has been saved in /home/cachedmemory/.ssh/id_rsa.pub.

The key fingerprint is:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx cachedmemory@localhost

The key's randomart image is:

You should have two files created in the default folder: id_rsa and id_rsa.pub. These are your private and public keys. Woo hoo!

Okay - lets get cracking on generating that certificate things like browsers use, the X509 certificate.

cachedmemory> cd .ssh

cachedmemory> openssl req -new -x509 -key id_rsa -out unsigned-cert.csr -days 1095

(Enter whatever values you feel are necessary.)

You now have a .csr file you can use. All set!