5.2.9 Usage examples of the openssl.bat and openssl.sh commands

This subsection provides examples of how to use the openssl.bat and openssl.sh commands. The information provided in the following examples, such as for the Common Name item, is fictitious, and any connection with real individuals is purely coincidental.

Organization of this subsection

(1) Generating a private key (openssl.bat or openssl.sh command)
(2) Creating a Certificate Signing Request (CSR) (openssl.bat req or penssl.sh req command)

(1) Generating a private key (openssl.bat or openssl.sh command)

(a) When using RSA encryption

The following example shows how to use the commands to generate a private key for RSA encryption.

Usage example (in Windows)

# openssl.bat genrsa -rand file -out httpsdkey.pem 1024
Generating RSA private key, 1024 bit long modulus
...............++++++
..............................++++++
e is 65537 (0x10001)
#

Usage example (in UNIX)

# openssl.sh genrsa -rand file -out httpsdkey.pem 1024
Generating RSA private key, 1024 bit long modulus
...............++++++
..............................++++++
e is 65537 (0x10001)
#

Contents of the private key for RSA encryption

The contents of the private key for RSA encryption are as follows:

(b) When using elliptic curve cryptography

The following example shows how to use the commands to generate a private key for elliptic curve cryptography.

Usage example (in Windows)

# openssl.bat ecparam -genkey -noout -rand file -name P-256 -out httpsdkey-tmp.pem
#

Usage example (in UNIX)

# openssl.sh ecparam -genkey -noout -rand file -name P-256 -out httpsdkey-tmp.pem
#

The following example shows how to use the command to convert a generated private key to the PKCS#8 format.

Usage example (in Windows)

# openssl.bat pkcs8 -topk8 -in httpsdkey-tmp.pem -out httpsdkey-ecc.pem -nocrypt
#

Usage example (in UNIX)

# openssl.sh pkcs8 -topk8 -in httpsdkey-tmp.pem -out httpsdkey-ecc.pem -nocrypt
#

Contents of the private key for elliptic curve cryptography

The contents of the private key for elliptic curve cryptography are as follows:

To Page Top

(2) Creating a Certificate Signing Request (CSR) (openssl.bat req or penssl.sh req command)

The following example shows how to use the commands to create a Certificate Signing Request (CSR). Submit the created CSR file to a CA to receive a signed certificate. Note that if you set a password when creating the private key of the Web server, you are also requested to enter the private key password when creating the CSR.

Specify the items and contents according to the instructions provided by the CA to which the CSR is submitted.

Usage example (in Windows)

# openssl.bat req -new -sha1 -key httpsdkey.pem -out httpsd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Kanagawa
Locality Name (eg, city) []:Yokohama-shi
Organization Name (eg, company) [Internet Widgits Pty Ltd]:HITACHI
Organizational Unit Name (eg, section) []:WebSite
Common Name (e.g. server FQDN or YOUR name) []:www.hws.hitachi.co.jp
Email Address []:
 
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
#

Usage example (in UNIX)

# openssl.sh req -new -sha1 -key httpsdkey.pem -out httpsd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Kanagawa
Locality Name (eg, city) []:Yokohama-shi
Organization Name (eg, company) [Internet Widgits Pty Ltd]:HITACHI
Organizational Unit Name (eg, section) []:WebSite
Common Name (e.g. server FQDN or YOUR name) []:www.hws.hitachi.co.jp
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
#

CSR format

The CSR format is as follows:

To Page Top