![Create a Self-Signed Certificate on Ubuntu 24.04 for Apache and Nginx](https://www.ssdnodes.com/wp-content/uploads/2024/07/1-2.jpg)
Why Create a Self-Signed Certificate on Ubuntu?
Once you create a self-signed certificate on Ubuntu, SSL/TLS encryption will protect your data transfer and prevent sensitive data exposure, in addition to ensuring that the connection is between the correct entities by cryptographically verifying that you’re connecting with an authentic server, and that the messages have not been interfered with while being transferred. Note: From now on we will refer to SSL/TLS certificates as simply "SSL certificates" for brevity.How to Create a Self-Signed Certificate on Ubuntu
To create a self-signed certificate on Ubuntu, you'll need to use OpenSSL to generate a private key and a self-signed certificate, specifying the required details like the certificate's validity period and your organization's information. Next, you'll save the key and certificate files in a secure location, and then use it in your Apache or Nginx server configuration.(Special Offer) - Simplify Your SSL Setup with Our 1-Click VPS Applications
If generating a self-signed SSL certificate sounds daunting, we've got you covered. Our 1-Click VPS applications (WordPress, phpMyAdmin, LAMP, and LEMP, and many others) come with a pre-installed self-signed SSL certificate. Just a few clicks and you're ready to go! Visit our website to get started with the lowest-cost VPS offerings in the world (self-signed certificates included)!
Step 1 - Using OpenSSL to Generate a Self-Signed Certificate
To create a self-signed certificate on Ubuntu, you will use OpenSSL to generate a certificate file that will store some basic information about your site, accompanied by an SSL private key file that will be kept secret in the server, and the server then will use it to securely handle encrypted data. OpenSSL is a software library that provides tools for general-purpose cryptography and secure communications. The private SSL key is used by the server to encrypt the content it sends to clients (e.g., web browser) The public SSL certificate is shared publicly with clients requesting the content. So when you request a page, the browser gets the SSL certificate from the server, and uses it to decrypt and access the content signed by the associated private SSL key. The first step to obtaining an SSL certificate is using OpenSSL to create a certificate signing request (CSR). In normal cases, the CSR will be sent to the Certificate Authority (CA) which in turn will create a certificate based on it. In our case (self-signed certificate), we will create the certificate ourselves based on this CSR we generate using OpenSSL. The CSR contains the common name(s) you want your certificate to secure, information about your company, and your public key.![Create a self-signed certificate on Ubuntu](https://www.ssdnodes.com/wp-content/uploads/2024/07/How-to-Create-a-Self-Signed-Certificate.png)
openssl
library, you will use the openssl req
command with the following command structure:
openssl req -x509 -newkey rsa:<rsa_value> -nodes -out <public certificate path> -keyout <private key path> -days <certificate duration in days> -subj "C=<country code>/O=<organization name>/OU=<organizational unit>/CN=<common name>"
Here is what each part of the preceding command means:
-x509
: A multi-purpose certificate utility. It can be used to display certificate information, convert certificates to various forms, sign certificate requests like a "mini CA" or edit certificate trust settings.-newkey
: Specifies that a new private key should be created with the certificate request.-rsa:
: The encryption algorithm you’ll use to generate your key. While you can use other encryption algorithms if you want, RSA is one of the best encryption systems that you can use to protect your data in transmission, especially because it comes with great compatibility.<rsa_value>
represents the key size in bits.-nodes
: is not the English word "nodes", it refers, instead, to "no DES". When given as an argument, it means OpenSSL will not encrypt the private key in a PKCS#12 file, and the private key will not have a passphrase. This is important for the web server to have access to the certificate file without needing a passphrase. Otherwise the server would wait for the user to manually enter the passphrase every time the server restarts, which is not convenient.-out
: defines the path the public key will be generated to, including the filename.-keyout
: defines the path the private key will be generated to, including the filename.-days
: The certificate’s lifetime in days.-subj
: is used to provide all the necessary information within the command itself, instead of having to provide each required piece of information via command line prompts.C
defines the two-letter country code where your company is legally located.O
defines the organization’s name.OU
defines the organizational unit name, which can be the name of your department within the organization.CN
is the common name, where you either enter the fully-qualified domain name (FQDN) you’ll use to access the server by (e.g., www.example.com), or the public IP of the server.
openssl
command options and actions, you can form and execute anContinue reading this article
by subscribing to our newsletter.
Subscribe nowby subscribing to our newsletter.
A note about tutorials: We encourage our users to try out tutorials, but they aren't fully supported by our team—we can't always provide support when things go wrong. Be sure to check which OS and version it was tested with before you proceed.
If you want a fully managed experience, with dedicated support for any application you might want to run, contact us for more information.