← script library

A Comprehensive Guide to Creating a Self-Signed Certificate Using OpenSSL

System AdministrationDecember 29, 2024

In today's digital landscape, securing communications is paramount. One effective way to do this is by utilizing SSL/TLS certificates to encrypt data exchanged between servers and clients. While obtaining a certificate from a trusted certificate authority (CA) is standard practice for production environments, creating a self-signed certificate using OpenSSL is an excellent option for testing and development. OpenSSL is an open-source implementation of the SSL and TLS protocols. It provides a robust toolkit for managing certificates, cryptographic keys, and secure communications. Self-signed certificates are beneficial in various scenarios, especially for development, internal systems, or testing environments. Unlike certificates issued by a CA, self-signed certificates do not require additional costs. However, they are not widely trusted by browsers and should not be used for public-facing websites. To create a self-signed certificate using OpenSSL, ensure that you have OpenSSL installed on your system, access to a command-line interface (Terminal for macOS/Linux and Command Prompt/PowerShell for Windows), and basic command-line knowledge.

shell
brew install openssl

sudo apt update
sudo apt install openssl

openssl genpkey -algorithm RSA -out private.key -pkeyopt rsa_keygen_bits:2048

openssl req -new -key private.key -out certificate.csr

openssl x509 -req -days 365 -in certificate.csr -signkey private.key -out selfsigned.crt

openssl x509 -text -noout -in selfsigned.crt

<VirtualHost *:443>
    ServerName your_domain.com
    SSLEngine on
    SSLCertificateFile /path/to/selfsigned.crt
    SSLCertificateKeyFile /path/to/private.key
</VirtualHost>

server {
    listen 443 ssl;
    server_name your_domain.com;
    ssl_certificate /path/to/selfsigned.crt;
    ssl_certificate_key /path/to/private.key;
}

# For Apache
sudo systemctl restart apache2
# For Nginx
sudo systemctl restart nginx

Run it across your fleet

This script runs as-is on a single host. Paste it into ServerEngine to schedule it, run it on a whole server group in parallel, and keep the credentials out of the file — see the scripts documentation and the credential store.

Ready when you are.

Try ServerEngine free for 7 days.