Creating the Certificate Using OpenSSL

Technical Articles

Solution

Application

Content Type

Technical Documentation

Utilities & Services

ft:locale

en-US

Open the command prompt or Terminal.
Create a folder on your desktop named Certs and navigate to the directory using the following commands:
```
mkdir /path/to/Desktop/Certs
cd /path/to/Desktop/Certs
```
Generate a Private Key and CSR by executing a command similar to the following:
```
openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
```
When prompted, enter the appropriate information.
The certificate authority (CA) administrator should be able to provide the desired values for these fields. Ensure that you use a fully qualified domain name (FQDN), such as jamf.mycompany.com.
Send the CSR you just created to a valid CA (public or internal).
You should receive a .crt, .cer, or .pem file in return. See your CA vendor's documentation for more information.
Note:
If you are requesting separate certificates, request a Base 64 encoded binary (X.509.)
Place the certificates you receive into the Certs folder on your desktop.
Import the signed certificates into your keystore. Refer to one of the following subsections depending on the type of files received from the certificate authority:
If you receive a .p7b file from the certificate authority:
1. Convert the .p7b file to a .cer file with the following command:
```
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer
```
2. Combine the new .cer file with the private key via this command:
```
openssl pkcs12 -export -out SSLCertificate.p12 -inkey privateKey.key -in certificate.cer
```
3. Enter an export password. This password is your keystore password, and will need to be recorded for future use.
If you receive individual certificates from the certificate authority:
1. Put them in place of each intermediate certificate in the following command:
```
openssl pkcs12 -export -out SSLCertificate.p12 -inkey privateKey.key -in serverCertificate.crt -certfile Intermediate.crt
```
  Note:
  You will add or remove the -certfile /path/to/intermediate parameter based on how many intermediate certificates the vendor has provided.
2. Enter an export password. This password is your keystore password, and will need to be recorded for future use.
If you get a bundle certificate from the certificate authority:
You may use it in place of the root certificate. This removes the need for any intermediate certificates.
Enter an export password. This password is your keystore password, and will need to be recorded for future use.