OpenSSL Step By Step Tutorial | How to Generate Keys, Certificates & CSR Using OpenSSL

OpenSSL step by step tutorial explaining how to generate key pair, how to export public key using openssl commands, how to create CSR using openSSL and how to generate self signed certificate using Open SSL command line tool.
To dowload openSSL visit: www.openssl.org/
To learn how to use Java Key Tool to generate self signed certificates: • How to Generate Key St...
To learn how to use Portecle to generate self signed certificates: • Generate Self Signed C...
To learn difference between one-way and two-way SSL: • How One Way and Two Wa...

[@florinbujoreanu1020]

BRAVO! thank you for the clear and practical explanation!

[@Marek-MAROGO]

Thanks from Poland!👍

[@lorenzomagni9200]

wow everything worked so flawlessly, you're a hero

[@azontoboynate]

Lot's of CSR videos but this one was perfect! Thank you!

[@TheL337trance]

I needed someone to explain it like this for so long. Thank you man.

[@rfrancoi]

Excellent video Sir. Thank you; it is greatly appreciated.

[@sachinmarawar7617]

Very well demonstrated key-pair generation, extracting public key, CSR and self-signed certificate. Great work!

[@BirdFinder100]

Excellent demonstration sir. Thank you for making this clear to me.

[@michaelareay1037]

Good job done. Very clearly explained and everything was right to the point and it held my attention. Everyone should do their training videos like this.

[@morningmotivation4745]

It cleared all my doubts..nicely explained..thanks for the amazing video..!

[@shanrk2972]

Short video, simple to understand. WOW!!! Thank you

[@bobbiecorner]

Great video ... I was confused before watching this, now I understand much better. Thanks.

[@raufmedappil]

Thanks a lot bro..I was looking for a simple but explanatory tutorial on how certificates work..this video helped me to understand a lot

[@TutorialsPediaVideos]

JazakAllah Abdul Rauf. Glad that It helped.

[@mwitschi69]

Just created my first key, ever. Now going to implement this....

[@ImranKhanVlogs8010]

Awesome. This is what I needed this morning.

[@ad1450]

Thanks a lot .Love from India

[@jakobyaro6428]

thanks bro, you are the best

[@dancewitharun]

Clear explanation to the point. Thanks buddy. Keep uploading more videos like this.

[@yv9296]

excellent video. thank you.

[@mazbahurrahman6787]

Worked for me, best video on openssl

[@thanmayanaik2002]

Thanks a lot for the precise, and informative video.

[@gadhoodhle]

Very useful - clear and consise. Thanks for sharing.

[@TutorialsPediaVideos]

JazakAllah. Thanks

[@ankursingh7505]

Great Video, Very clearly explained about CA, CSR.
I have a question:
When we are opening the //https connection using self signed CA certificate getting some warnings on //https web page. May I know the reason?
Kindly, respond.
Thanks

[@TutorialsPediaVideos]

Dear Ankur,
Thanks for the kind feedback.
In case of a self-signed certificate, we get SSL warning because chain of trust is not identified by the browser. Browser trusts only CA signed certificates (unless you explicitly add your certificate in the trust store).
I will recommend you to watch my other video where I explained SSL chain of trust in much detail.

[@HistoryChannel80]

Thank you very much. Was thinking I will never get it with this csr.

[@ganeshraj5328]

Thankyou. Video was very clear

[@santhoshnagamalla4302]

Awesome explanation bro !!!

[@LaeeqKhan01]

Very nice job.
Please add info on how to create "non-self-signed certificates". Meaning certificate verifying some other public key. Thanks

[@travelwalk539]

Good explanation , keep it up

[@ravikalkote1729]

Great video.. all commands worked for me...thanks...one query how to add critical extensions using your commands?

[@AQEELAbdulmajeed-dh1ti]

I Like it.

[@brajeshpatel2810]

superb knowledge ... my friend .. keep sharing it..

[@madhamsettypreetham1261]

Thanks for the clear explanation

[@User-nq9ee]

all those who are having error like me
The only thing that worked for me in this situation was the self-created openssl.cnf file.
Here are the basics needed for this exercise (edit as needed):
#
# OpenSSL configuration file.
#
# Establish working directory.
@/c:\Users\User\Desktop\test
dir = .
[ ca ]
default_ca = CA_default
[ CA_default ]
serial = $dir/serial
database = $dir/certindex.txt
new_certs_dir = $dir/certs
certificate = $dir/cacert.pem
private_key = $dir/private/cakey.pem
default_days = 365
default_md = md5
preserve = no
email_in_dn = no
nameopt = default_ca
certopt = default_ca
policy = policy_match
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ req ]
default_bits = 1024 # Size of keys
default_keyfile = key.pem # name of generated keys
default_md = md5 # message digest algorithm
string_mask = nombstr # permitted characters
distinguished_name = req_distinguished_name
req_extensions = v3_req
[ req_distinguished_name ]
# Variable name Prompt string
#------------------------- ----------------------------------
0.organizationName = Organization Name (company)
organizationalUnitName = Organizational Unit Name (department, division)
emailAddress = Email Address
emailAddress_max = 40
localityName = Locality Name (city, district)
stateOrProvinceName = State or Province Name (full name)
countryName = Country Name (2 letter code)
countryName_min = 2
countryName_max = 2
commonName = Common Name (hostname, IP, or your name)
commonName_max = 64
# Default values for the above, for consistency and less typing.
# Variable name Value
#------------------------ ------------------------------
0.organizationName_default = My Company
localityName_default = My Town
stateOrProvinceName_default = State or Providence
countryName_default = US
[ v3_ca ]
basicConstraints = CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
[ v3_req ]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
# copy till here
now save this file and run the command as
openssl req -new -key tutorialspedia.key -out tutorialspedia.csr -config openssl.cnf
hope this will work for you :)

[@andresfd89]

Thank you very much, very clear and to the point!

[@icanada4]

Thank you!

[@datonernegen]

Thank you, really helped me!

[@raghuZanne]

Awesome explanation. Thank you!

[@asuteles201]

Hi sir,
I want to configure certificate based authentication, it requirement
1.CA,
2.User Certificate,
3.server certificate.
What should I do, whether is same with you do?

[@vivekprajapati7911]

really great way of teaching thanks.

[@TutorialsPediaVideos]

Thanks for your feedback Vivek.

[@gildonghong563]

Thank you bro!!
you are save my life!!

[@jurijus01]

Thanks a lot!!! Exactly what I was looking for

[@selvendranbtech]

Good explanation in detail. I have one query in terms of renewal. To renew the existing CA signed certificate, is it correct to give old CSR (CSR generated to get CA signed initially). Is there any validity for key pair and CSR generated?

[@demontagemontage]

how to creat command "CLS" clear screen in this toolkit , or same equivalent???????????????????????

[@engrkn]

Good job mate :) PK/ISB at last someone from PK

[@izhaanabid5312]

So happy to see that. Subbed him.

[@noorullashaik1784]

Good job clearly explained

[@jibrankhan499]

Job saving info for me.

[@AlHoussem]

Great Tutorial, Thanks

[@rupeshgawas4905]

thank you bhai

[@georgebenjamin6632]

Well done for this nice video

[@unemployedcse3514]

Awesome 😍

[@cheers1963]

Thank you sir

[@electrotsmishar]

very helpful. thank you

[@SupraRyu]

Great job!

[@dennisgarber]

Great video, but you now have weird files on your computer. What do you do with these weird files. Do I ftp to my server, control panel, do I need to go to ican or other ssl org to upload them?

[@pabloandrade339]

The video is good but you have a major mistake. I think the video is using the entire key pair file instead of the public key to generate the CSR which in turn will go to the CA. This is a very important piece of information that will kill you in any test or interview. The steps are correct but the files being used are wrong. The CSR should be created only with the public key file, the CA will generate a certificate. After verification, the CA sends you a signed digital certificate that contains your distinguished name, your public key, the CA's distinguished name, and the signature of the certificate authority. You store this signed certificate in your key database.

[@LeXT89]

Are you serious ? "CSRs are signed using the private key to prevent tampering in transit to the CA.

[@flymoracer]

@@LeXT89 That’s correct. The private key file, which also contains the public key information, is used to sign the CSR. The CSR does not contain the private key. It isn't necessary to extract the public key to create a CSR. OpenSSL supports the creation of the CSR directly from the private key file.

[@AlianeAbdelouahab]

this is just perfect, simple, effective !

[@mta5948]

good video, very nicely explained. thanks

[@KeremPARLAKGUMUS-uc4xb]

thank you very much, it was very useful

[@jiten6mar]

Nice video in detail. I have one question in terms of renewal. To renew the existing CA signed certificate, is it correct to give old CSR (CSR generated to get CA signed initially). Is there any validity for key pair and CSR generated?

[@ruchigarg7788]

Thanks, Its really helpful.

[@TutorialsPediaVideos]

You are welcome Ruchi.

[@ajaiyapandey5058]

Thanks for the great tutorials. How I securely push these key (private & cer) in jks file ?

[@amj7573]

Very nice video. Thank you very much. How to create certificate with encryption and does the server also should have a certificate with encrypted key? And also can we use Portecle to generate certificates with encrypted key for linux?

[@6962943]

wow thank you explained so clearly

[@EndlessTech]

Very informative 😊👏

[@mark-theeverydayimagineer6163]

Great presentation - thanks

[@TutorialsPediaVideos]

Thanks for your kind feedback Mark.

[@My_Name_Is_Prashant]

wow..
It helped me a lot

[@gianlucavenditti4109]

Good job! Thank you!

[@itigloostudio957]

Thanks.

[@Jennn]

Thank you So Much Sir

[@enriquecaballero15]

great tutorial, thank you!

[@TutorialsPediaVideos]

Thanks for your feedback Enrique.

[@Nyemaster]

Thanks - I had all this confused. You helped a lot. Now how do I get this into Windows 10?

[@TutorialsPediaVideos]

Thanks Dave for your feedback. You can download windows version of openssl and use it in your machine. I myself created this tutorial in Windows 10.

[@mubasherchaudhary5223]

I also had a problem with installing it on windows but then I found this tutorial helpful
th-cam.com/video/YNKUpNpM0Q0/w-d-xo.html&ab_channel=TechDeepDiveTechDeepDive

[@EamoAmin]

Thank you

[@namanbajpai6107]

Thanks ..

[@amirkian1181]

Can you tell me how we can extract the private key from the key pair, as well as the public key?

[@dovelrob]

thanks for your help bro

[@TutorialsPediaVideos]

You are welcome Roberto.

[@edalee5935]

It's very helpful~!

[@TutorialsPediaVideos]

Glad to hear that it helped.

[@bhaveshdwivedi3549]

CAn you create an video about self signing code signing certificate

[@Mocka-yf4ez]

awsome!!!!!!

[@bharathikommu9016]

Hisir.
How do one vedio on how to create csr repo

[@jamely15]

Nice explanation ! Thank you !

[@TutorialsPediaVideos]

Thanks Jimmy. Glad that it was helpful.

[@lkinsmusic]

Hello when i use command for create csr file. This file is not shown when type dir command
it is not created. Why this issue happened ?

[@sharadregoti7742]

Can you also make a video on certificate chaining / Intermediate CAS

[@okey1317]

6:00 Why did you pass the initial key file? .. shouldnt we pass the public key file?

[@SureshBabu-of5jh]

In this case can we generate public keys and match with public keys being used by differenrt companies?

[@kishoreyadav9317]

I am getting Can't open -testauto.key for reading, No such file or directory error any idea ?? followed the same steps

[@ashishsulakhe3894]

same error bro

[@User-nq9ee]

@@ashishsulakhe3894 same here

[@carolinazubieta1349]

super

[@karthickd7]

Command to create self signed certificate with csr and private key is not working shows x509: Use -help for summary. any idea?

[@sudhanshutiwari7916]

how can we stop the stdin for step 3 like country name etc, and provide through argparser ?

[@shwetasugurmath5390]

If I want to create SSL certificates on cluster having 4-5 nodes, can we have same crt copied to all hosts?

[@JDavidFIG]

Good job friend!!

[@TutorialsPediaVideos]

Thanks David.

[@vipul6304]

Hi, how can get my Certicate Signed by 'CA' instead of Self-Signed?

[@TutorialsPediaVideos]

Hi Vipul,
Once you have created CSR, in order to get it signed by a CA, you need to share your CSR with a CA for the subsequent steps.

[@vipul6304]

@@TutorialsPediaVideos thanks, is there a free CA that you know?

[@sampande45]

How to solve the invalid digest for sha1 error while creating csr

[@kumarmanish9046]

3:25 you have not generated key PAIR right? You have just created the private key. Where is the public key?

[@My_Name_Is_Prashant]

where do we need self signed certificate in real world scenario...

[@fanig1458]

How should I verify that same csr for the crt that was created

[@vinaygowda7413]

so neat and clear. Exactly wt I need. Thanks

[@ceeeskayaar2281]

info given in this video was insufficient to running localhost with https using openssl certificate. It ended with net::cert_common_name_invalid error in chrome on windows and also with hhtps strickedout in url with no green lock in browser address bar. I appreciate further help to fix the error...

[@SherinSunny-rj3py]

i am getting an error saying warning can't open config file: C:/OpenSSL/openssl.cnf please do help

[@jackpitts5561]

too coder-centric, start by definiing the problem using vitual aides. What is happening from a helicopter view, what are the keys for, why are they needed, who holds which keys and why. etc....

[@TutorialsPediaVideos]

Dear Jack,
Thanks for your feedback. This tutorial is mainly covering opnssl commands from technical point of view.
For functional use cases, will create another video to address your concerns :)

[@saikrishnamerugu6118]

executing openssl command to generate key pair using "openssl genrsa -out keyfile.key 2048" but facing an error "genrsa: Can't open "keyfile.key" for writing, Permission denied". Could you guide me hot to fix this

[@TutorialsPediaVideos]

Run the cmd as an administrator