Edge Security
  • Overview
  • DDoS Protection
    • DDoS Protection Overview
    • Exclusive DDoS Protection Usage
    • Configuration of Exclusive DDoS protection Rules
      • Increase DDoS Protection Level
      • Exclusive DDoS Traffic Alarm
      • Configuration IP blocklist/allowlist
      • Configuration Region Blocking Rule
      • Configuration Port Filtering
      • Configuration Features Filtering
      • Configuration Protocol Blocking Rule
      • Configuration Connections Attack Protection
      • Related References
        • Action
        • Related Concepts Introduction
  • Web Protection
    • Overview
    • Configuring Web Protection Policy
    • Managed rules
    • CC attack defense
    • Bandwidth Abuse Protection
    • Custom rule
    • Custom Rate Limiting Rules
    • Exception Rules
    • Managed Custom Rules
    • Web security monitoring alarm
    • Refer
      • Web Protection Request Processing Order
      • Action
      • Match Condition
  • Bot Management
    • Overview
    • Bot Intelligent analysis
    • Bot Basic Feature Management
    • Client Reputation
    • Active Detection
    • Custom Bot Rule
    • Bot Exception Rule
    • Related References
      • Action
  • Rules Template
  • IP and IP Segment Grouping
  • Origin Protection
  • Custom Response Page
  • Alarm Notification
  • SSL/TLS
    • Overview
    • Deploying/Updating SSL Certificate for A Domain Name
    • Configuring A Free Certificate for A Domain Name
    • Mutual Authentication
    • HTTPS Configuration
      • Forced HTTPS Access
      • Enabling HSTS
      • SSL/TLS Security Configuration
        • Configuring SSL/TLS Security
        • TLS Versions and Cipher Suites
      • Enabling OCSP Stapling
    • Refer
      • Using OpenSSL to Generate Self-Signed Certificates
      • Certificate Format Requirements
    • Using Keyless Certificate
Docs Overview/
Edge Security/
SSL/TLS/
Refer/
Using OpenSSL to Generate Self-Signed Certificates/

Using OpenSSL to Generate Self-Signed Certificates

All server and client certificates generally need to be applied for from an authoritative certificate authority (CA) to ensure they are trusted by different operating systems and browsers. The CA usually charges a certain fee for the certificate. If you currently only need an HTTPS certificate for testing or in-house use, you can also manually issue a self-signed certificate using OpenSSL. The steps are as follows:
RSA Algorithm Certificate
ECC Algorithm Certificate

Step 1: Generate Root Certificate

1. Generate the root certificate private key through the following command, using an RSA certificate with a 4096 key length as an example, and save the generated private key as a ca-rsa.key file.
openssl genrsa -out ca-rsa.key 4096
2. Use the above certificate private key to generate a Certificate Signing Request (CSR) file, saved as ca-rsa.csr. The following command specifies the basic information of the certificate through -subj, where:
C=CN represents the country.
ST=State represents the province.
L=City represents the city.
O= Example Org represents the organization.
OU=Example CA represents the department.
CN=Example Root CA represents the common name of the certificate. In a CA certificate, this field can describe the purpose of the CA. If it is a domain name certificate, the domain name for certificate issuance needs to be specified in this field.
openssl req -new -key ca-rsa.key -out ca-rsa.csr -subj "/C=US/ST=State/L=City/O=Example Org/OU=Example CA/CN=Example Root CA"
3. Create the root certificate public key based on the certificate signing request file, with a validity of 3650 days, and save it as ca-rsa.crt. The -extfile parameter specifies this certificate as a CA certificate.
openssl x509 -req -in ca-rsa.csr -out ca-rsa.crt -signkey ca-rsa.key -days 3650 -sha256 -extfile <(printf "basicConstraints=critical,CA:TRUE\nkeyUsage=critical,keyCertSign,cRLSign\nsubjectKeyIdentifier=hash\n")
4. Issue the certificate and verify whether it is a CA certificate.
openssl x509 -in ca-rsa.crt -noout -text | grep -A2 "X509v3 Basic Constraints"
The output result contains CA:TRUE, which indicates a correct CA certificate. See the output result below:
X509v3 Basic Constraints: critical
                CA:TRUE    # Indicates the cert is a CA certificate.
            X509v3 Key Usage: critical

Step Two: Issue a Domain Name Certificate

To issue a certificate for the designated domain name www.example.com, you can use the generated CA certificate to start issuing a self-signed domain name certificate:
1. Generate the certificate private key through the following command, using an RSA certificate with a 4096 key length as an example, and save the generated private key as a rsa-domain.key file.
openssl ecparam -name secp384r1 -genkey -noout -out rsa-domain.key
2. Use the above certificate private key to generate a Certificate Signing Request (CSR) file, saved as rsa-domain.csr. The following command specifies the basic information of the certificate through -subj. Please note to replace the CN field content with the domain name you want to issue. In this example, www.example.com is used.
openssl req -new -key rsa-domain.key -out rsa-domain.csr -subj "/C=US/ST=State/L=City/O=Example Org/OU=Example CA/CN=www.example.com"
3. Sign the domain name certificate with the CA certificate, generate the public key with a validity of 3650 days, and save it as rsa-domain.crt.
openssl x509 -req -in rsa-domain.csr -out rsa-domain.crt -CA ca-rsa.crt -CAkey ca-rsa.key -days 3650
4. Compare the CA certificate with the domain name certificate public key to verify whether the certificate chain of the issued domain name certificate is correct.
openssl verify -CAfile ca-rsa.crt rsa-domain.crt
If the output result displays rsa-domain.crt:OK, it indicates that the certificate issuance chain is correct. See the following:
rsa-domain.crt: OK

Step 1: Generate Root Certificate

1. Generate the root certificate private key through the following command, using an ECC certificate with the secp384r1 encryption algorithm as an example, and save the generated private key as a ca-ecc.key file.
openssl ecparam -name secp384r1 -genkey -noout -out ca-ecc.key
2. Use the above certificate private key to generate a Certificate Signing Request (CSR) file, saved as ca-ecc.csr. The following command specifies the basic information of the certificate through -subj, where:
C=CN represents the country.
ST=State represents the province.
L=City represents the city.
O= Example Org represents the organization.
OU=Example CA represents the department.
CN=Example Root CA represents the common name of the certificate. In a CA certificate, this field can describe the purpose of the CA. If it is a domain name certificate, the domain name for certificate issuance needs to be specified in this field.
openssl req -new -key ca-ecc.key -out ca-ecc.csr -subj "/C=US/ST=State/L=City/O=Example Org/OU=Example CA/CN=Example Root CA"
3. Create the root certificate public key based on the certificate signing request file, with a validity of 3650 days, and save it as ca-ecc.crt. The -extfile parameter specifies this certificate as a CA certificate.
openssl x509 -req -in ca-ecc.csr -out ca-ecc.crt -signkey ca-ecc.key -days 3650 -sha256 -extfile <(printf "basicConstraints=critical,CA:TRUE\nkeyUsage=critical,keyCertSign,cRLSign\nsubjectKeyIdentifier=hash\n")
4. Issue the certificate and verify whether it is a CA certificate.
openssl x509 -in ca-ecc.crt -noout -text | grep -A2 "X509v3 Basic Constraints"
The output result contains CA:TRUE, which indicates a correct CA certificate. See the output result below:
X509v3 Basic Constraints: critical
                CA:TRUE    # Indicates the cert is a CA certificate.
            X509v3 Key Usage: critical

Step Two: Issue a Domain Name Certificate

To issue a certificate for the designated domain name www.example.com, you can use the generated CA certificate to start issuing a self-signed domain name certificate:
1. Generate the certificate private key through the following command, using an ECC certificate with the secp384r1 encryption algorithm as an example, and save the generated private key as a ecc-domain.key file.
openssl ecparam -name secp384r1 -genkey -noout -out ecc-domain.key
2. Use the above certificate private key to generate a Certificate Signing Request (CSR) file, saved as ecc-domain.csr. The following command specifies the basic information of the certificate through -subj. Please note to replace the CN field content with the domain name you want to issue, using www.example.com as an example in this case.
openssl req -new -key ecc-domain.key -out ecc-domain.csr -subj "/C=US/ST=State/L=City/O=Example Org/OU=Example CA/CN=www.example.com"
3. Sign the domain name certificate with the CA certificate, generate the public key with a validity of 3650 days, and save it as ecc-domain.crt.
openssl x509 -req -in ecc-domain.csr -out ecc-domain.crt -CA ca-ecc.crt -CAkey ca-ecc.key -days 3650
4. Compare the CA certificate with the domain name certificate public key to verify whether the certificate chain of the issued domain name certificate is correct.
openssl verify -CAfile ca-ecc.crt ecc-domain.crt
If the output result displays ecc-domain.crt:OK, it indicates that the certificate issuance chain is correct.
ecc-domain.crt: OK