Creating self signed SSL certificates

Ineffective oneliners is a pet peeve of mine, you know, useless use of cat or doing something | grep -v | grep -v | grep -v instead of a simple regexp.

This post is about generating self-signed SSL certificates with the OpenSSL and most guides would have you believe the best way to do this has three "simple" steps:

1. Create a key (pair).
2. Create a CSR (Certificate Signing Request) using that key.
3. Sign the CSR to get your self-signed certificate.

It seemed strange to me that it should be that complicated and after reading the man pages I figured out that as long as all you want is a self signed cert, it is indeed a lot easier:

openssl req -new -x509 -nodes -sha256 -days 4096 -verbose \
-subj /CN=example.com/ -newkey rsa:4096 \
-keyout private/example.com.key -out certs/example.com.pem

Instead of creating a CSR and then signing it, the -x509 argument tells openssl to just skip step 2 and self-sign and output a certificate directly. If you are not going to send the CSR to someone else for signing, it does not, IMNSHO, make any sense to create it in the first place.

The -newkey and -keyout arguments does away with step 1 and just creates (and saves) the key in the same command as the signing.

Further more, by supplying the common name via -subj, no interactive input is required. No other data is required for a regular certificate used for SSL.