How to Generate a CSR (Certificate Signing Request) in Linux

SSL Certificates fall into two broad categories: 1) Self-Signed Certificate which is an identity certificate that is signed by the same entity whose identity it certifies-on signed with its own private key, and 2) Certificates that are signed by a CA (Certificate Authority) such as Let’s Encrypt, Comodo and many other companies.

Self-Signed Certificates are commonly used in test environments for LAN services or applications. They can be generated for free using OpenSSL or any related tool. On the other hand, for sensitive, public-facing production services, applications or websites, it is highly recommended to use a certificate issued and verified by a trusted CA.

The first step towards acquiring an SSL certificate issued and verified by a CA is generating a CSR (short for Certificate Signing Request).

In this article, we will demonstrate how to create a CSR (Certificate Signing Request) on a Linux system.

Creating a CSR – Certificate Signing Request in Linux

To create a CSR, you need the OpenSSL command line utility installed on your system, otherwise, run the following command to install it.

$ sudo apt install openssl  [On Debian/Ubuntu]
$ sudo yum install openssl  [On CentOS/RHEL]
$ sudo dnf install openssl  [On Fedora]

Then issue the following command to generate a CSR and the key that will protect your certificate.

$ openssl req -new -newkey rsa:2048 -nodes -keyout -out


  • req enables the part of OpenSSL that handles certificate requests signing.
  • -newkey rsa:2048 creates a 2048-bit RSA key.
  • -nodes means “don’t encrypt the key”.
  • -keyout specifies the filename to write on the created private key.
  • -out specifies the filename to write the CSR to.

Answer correctly, the questions you will be asked. Note that your answers should match information in legal documents regarding the registration of your company. This information is critically checked by the CA before issuing your certificate.

Generate CSR in Linux

Generate CSR in Linux

After creating your CSR, view the contents of the file using a cat utility, select it and copy it.

$ cat
Copy CSR Key

Copy CSR Key

Then go back to your CA’s website, log in, go to the page will contain the SSL certificate you purchased, and activate it. Then in a window such as the one below, paste your CSR in the correct input field.

In this example, we created a CSR for a multiple domain certificate purchased from Namecheap.

Active CSR from CA Website

Active CSR from CA Website

Then follow the rest of the instructions to initiate activation of your SSL certificate. For more information about OpenSSL command, see its man page:

$ man openssl

That’s all for now! Always remember that the first step to getting your own SSL certificate from a CA is to generate a CSR. Use the feedback form below to ask any questions or share your comments with us.

Best Affordable Linux and WordPress Services For Your Business
Outsource Your Linux and WordPress Project and Get it Promptly Completed Remotely and Delivered Online.

If You Appreciate What We Do Here On TecMint, You Should Consider:

  1. Stay Connected to: Twitter | Facebook | Google Plus
  2. Subscribe to our email updates: Sign Up Now
  3. Get your own self-hosted blog with a Free Domain at ($3.45/month).
  4. Become a Supporter - Make a contribution via PayPal
  5. Support us by purchasing our premium books in PDF format.
  6. Support us by taking our online Linux courses

We are thankful for your never ending support.

Aaron Kili

Aaron Kili is a Linux and F.O.S.S enthusiast, an upcoming Linux SysAdmin, web developer, and currently a content creator for TecMint who loves working with computers and strongly believes in sharing knowledge.

Your name can also be listed here. Got a tip? Submit it here to become an TecMint author.

RedHat RHCE and RHCSA Certification Book
Linux Foundation LFCS and LFCE Certification Preparation Guide

You may also like...

Got something to say? Join the discussion.

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.