Step-by-Step Guide to Generating a Self-Signed SSL Certificate

A self-signed certificate is a certificate that is signed by the same entity that created it, using its private key, without the involvement of a trusted certificate authority. This guide provides step-by-step instructions to create a self-signed SSL/HTTPS certificate using OpenSSL and PowerShell.

1. Prerequisites

• OpenSSL / PowerShell
• Windows / Linux / Mac

2. Step-by-Step Guide to Generating a Self-Signed Certificate Using OpenSSL

Step 1: Open Your Command Line

Open your terminal (Linux, macOS) or command prompt (Windows). Ensure you have OpenSSL access by typing:

openssl version

If it returns a version number, OpenSSL is installed. If not, you’ll need to install it.

Step 2: Generate a Private Key

A private key is needed to generate the certificate. This key will be used to encrypt and secure the connection.

Type the following command to create a 2048-bit RSA private key:

openssl genpkey -algorithm RSA -out private.key -pkeyopt rsa_keygen_bits:2048 -aes256

Step 3: Create a Certificate Signing Request (CSR)

The CSR is required by Certificate Authorities to validate your information. Since we’re self-signing, we’ll still need this for setting up the certificate.

Run this command to generate a CSR:

openssl req -new -key private.key -out request.csr

You’ll be asked several questions:

important Note: If you are creating certificate for only one domain then follow the step 4 and skip step 5 & 6 and if you want to create certificate for multiple domains, then skip step 4 and follow step 5 & 6

Step 4: Generate the Self-Signed Certificate

Now, we’ll create the certificate itself, which will be valid for 365 days.

Run this command:

openssl x509 -req -days 365 -in request.csr -signkey private.key -out certificate.crt

In case if you want to add multiple domain names you can follow this step.

Step 5: Create the Extension File

First, create an extension file that contains the Subject Alternative Names (SANs).

For Linux and Windows, create a text file named san.ext with the following content:

subjectAltName=DNS:example.com,DNS:www.example.com,DNS:example2.com

Step 6: Generate a Self-Signed Certificate with SAN

Once the san.ext file has been created, you can use it with the -extfile flag to generate the self-signed certificate. The command is the same on both Linux, Mac, Windows:

openssl x509 -req -days 365 -in request.csr -signkey private.key -out certificate.crt -extfile san.ext

Step 7: Verify the Certificate

You can check the certificate details with the following command:

openssl x509 -in certificate.crt -text -noout

Step 8: Export to PFX File

After creating the .crt certificate and .key file, you can combine them into a .pfx file using this command:

openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crt

You’ll be prompted to enter an export password, which will protect the .pfx file. Remember this password, as you’ll need it when importing the .pfx file into a server.

3. Step-by-Step Guide to Generating a Self-Signed Certificate Using PowerShell

In this guide, we will create an HTTPS / SSL certificate using PowerShell. This type of certificate is used to ensure secure communication over an HTTP server, like a website or a web service. HTTPS certificates are essential to encrypt the data and verify the server’s identity to the client.

Step 1: Open PowerShell as Administrator

1. Press the Start button.
2. Type PowerShell in the search bar.
3. Right-click on Windows PowerShell and select Run as administrator.

Note: Running PowerShell as an administrator is essential to ensure you have the correct permissions to create and manage certificates.

Step 2: Use the New-SelfSignedCertificate Cmdlet to Create an HTTPS Certificate

To generate an HTTPS / SSL certificate, we will use the New-SelfSignedCertificate command in PowerShell. This certificate will be used for an HTTPS server to authenticate itself and provide a secure connection.

$cert = New-SelfSignedCertificate -DnsName "myhttpsdomain.com" -CertStoreLocation "Cert:\LocalMachine\My" -KeyUsage DigitalSignature, KeyEncipherment -Type SSLServerAuthentication

Step 3: Capture the Thumbprint

Since we stored the certificate object in the $cert variable, we can easily retrieve the Thumbprint without having to search through a list of certificates.

$thumbprint = $cert.Thumbprint

This command extracts the Thumbprint from the certificate object and saves it into a variable called $thumbprint

Step 4: Export the HTTPS / SSL Certificate to a PFX File

Next, we’ll export the certificate to a PFX file. This step is useful if you need to move the certificate to another server or use it with another application.

First, create a password for the PFX file. This password will protect the private key included in the PFX file:

$password = ConvertTo-SecureString -String "YourPasswordHere" -Force -AsPlainText

Now, use the Export-PfxCertificate command to export the certificate:

Export-PfxCertificate -Cert "Cert:\LocalMachine\My\$thumbprint" -FilePath "C:\MyHttpsCertificate.pfx" -Password $password

Complete PowerShell script to create HTTPS / SSL certificate

# Step 1: Create the HTTPS certificate and save it to a variable
$cert = New-SelfSignedCertificate -DnsName "myhttpsdomain.com" -CertStoreLocation "Cert:\LocalMachine\My" -KeyUsage DigitalSignature, KeyEncipherment -Type SSLServerAuthentication

# Step 2: Capture the thumbprint of the certificate
$thumbprint = $cert.Thumbprint

# Step 3: Set a password for exporting the certificate
$password = ConvertTo-SecureString -String "YourPasswordHere" -Force -AsPlainText

# Step 4: Export the certificate to a PFX file in C drive
Export-PfxCertificate -Cert "Cert:\LocalMachine\My\$thumbprint" -FilePath "C:\MyHttpsCertificate.pfx" -Password $password


# Step 6: Verify the certificate installation
Get-ChildItem -Path "Cert:\LocalMachine\My" | Where-Object { $_.Thumbprint -eq $thumbprint }