How to Create a Self-Signed Certificate on Ubuntu 24.04 for Apache and Nginx

The last thing you want is to have your sensitive data hijacked because of bad web security practices. That's why you absolutely must create a self-signed certificate on your Ubuntu 24.04 VPS for your Apache or Nginx server. Securing your web traffic with SSL/TLS encryption to handle HTTPS communications is an essential part of building any public or private web service, because without it, your web service will have weak privacy and insecure data transfer, and users won’t trust your services.

Why Create a Self-Signed Certificate on Ubuntu?

Once you create a self-signed certificate on Ubuntu, SSL/TLS encryption will protect your data transfer and prevent sensitive data exposure, in addition to ensuring that the connection is between the correct entities by cryptographically verifying that you’re connecting with an authentic server, and that the messages have not been interfered with while being transferred. Note: From now on we will refer to SSL/TLS certificates as simply "SSL certificates" for brevity.

How to Create a Self-Signed Certificate on Ubuntu

To create a self-signed certificate on Ubuntu, you'll need to use OpenSSL to generate a private key and a self-signed certificate, specifying the required details like the certificate's validity period and your organization's information. Next, you'll save the key and certificate files in a secure location, and then use it in your Apache or Nginx server configuration.

(Special Offer) - Simplify Your SSL Setup with Our 1-Click VPS Applications

If generating a self-signed SSL certificate sounds daunting, we've got you covered. Our 1-Click VPS applications (WordPress, phpMyAdmin, LAMP, and LEMP, and many others) come with a pre-installed self-signed SSL certificate. Just a few clicks and you're ready to go! Visit our website to get started with the lowest-cost VPS offerings in the world (self-signed certificates included)!

Step 1 - Using OpenSSL to Generate a Self-Signed Certificate

To create a self-signed certificate on Ubuntu, you will use OpenSSL to generate a certificate file that will store some basic information about your site, accompanied by an SSL private key file that will be kept secret in the server, and the server then will use it to securely handle encrypted data. OpenSSL is a software library that provides tools for general-purpose cryptography and secure communications. The private SSL key is used by the server to encrypt the content it sends to clients (e.g., web browser) The public SSL certificate is shared publicly with clients requesting the content. So when you request a page, the browser gets the SSL certificate from the server, and uses it to decrypt and access the content signed by the associated private SSL key. The first step to obtaining an SSL certificate is using OpenSSL to create a certificate signing request (CSR). In normal cases, the CSR will be sent to the Certificate Authority (CA) which in turn will create a certificate based on it. In our case (self-signed certificate), we will create the certificate ourselves based on this CSR we generate using OpenSSL. The CSR contains the common name(s) you want your certificate to secure, information about your company, and your public key. Note: In order for a CSR to be created, it needs to have a private key from which the public key is extracted. This can be done by using an existing private key or generating a new private key. It is strongly recommended to generate a new private key when creating a CSR instead of using an existing one. To create a certificate signing request (CSR) and a private key with the openssl library, you will use the openssl req command with the following command structure:

openssl req -x509 -newkey rsa:<rsa_value> -nodes -out <public certificate path> -keyout <private key path> -days <certificate duration in days> -subj "C=<country code>/O=<organization name>/OU=<organizational unit>/CN=<common name>"

Here is what each part of the preceding command means:

• -x509: A multi-purpose certificate utility. It can be used to display certificate information, convert certificates to various forms, sign certificate requests like a "mini CA" or edit certificate trust settings.
• -newkey: Specifies that a new private key should be created with the certificate request.
• -rsa:: The encryption algorithm you’ll use to generate your key. While you can use other encryption algorithms if you want, RSA is one of the best encryption systems that you can use to protect your data in transmission, especially because it comes with great compatibility. <rsa_value> represents the key size in bits.
• -nodes: is not the English word "nodes", it refers, instead, to "no DES". When given as an argument, it means OpenSSL will not encrypt the private key in a PKCS#12 file, and the private key will not have a passphrase. This is important for the web server to have access to the certificate file without needing a passphrase. Otherwise the server would wait for the user to manually enter the passphrase every time the server restarts, which is not convenient.
• -out: defines the path the public key will be generated to, including the filename.
• -keyout: defines the path the private key will be generated to, including the filename.
• -days: The certificate’s lifetime in days.
• -subj: is used to provide all the necessary information within the command itself, instead of having to provide each required piece of information via command line prompts.
  • C defines the two-letter country code where your company is legally located.
  • O defines the organization’s name.
  • OU defines the organizational unit name, which can be the name of your department within the organization.
  • CN is the common name, where you either enter the fully-qualified domain name (FQDN) you’ll use to access the server by (e.g., www.example.com), or the public IP of the server.

Now that you are familiar with the openssl command options and actions, you can form and execute an