Generate CSR - OpenSSL

Mar 16, 2026

Generate CSR - OpenSSL

Guidelines

1. Accessing OpenSSL:

   • GNU/Linux & Mac OS X Users: Open a terminal and browse to a folder where you would like to generate your keypair.

   • Windows Users: Access the OpenSSL bin directory and open a command prompt in the same location.

2. Generating a CSR and a Private Key:

   Encrypted Private Key Syntax: openssl req -out CSR.csr -new -newkey rsa:2048 -keyout privatekey.key
    

   IMPORTANT: You will need to provide a password when prompted. You need this password to access the private key, so make sure you store it safely.

     

   Command	Purpose
   openssl req	Calls the OpenSSL utility for PKCS#10 X.509 CSR management
   -out CSR.csr	Specifies the name of the output file for the generated CSR
   -new	Indicates that a new certificate request is being created
   -newkey rsa:2048	Instructs OpenSSL to generate a new RSA (Rivest-Shamir-Adleman)private key with a length of 2048-bits, which is the current industry standard for security NOTE: To generate a 4096-bit CSR, replace the rsa:2048 syntax with rsa:4096 as shown. openssl req -out CSR.csr -new -newkey rsa: 4096 -keyout privatekey.key
   -keyout privatekey.key	Indicates the file name that will be used to store the newly generated private key Use privatekey.key to define the private key file name.

3. Fill out the following fields as prompted:

NOTE: The following special characters are not accepted in the CSR subject fields and are enforced by Certificate Authorities: < > ~ ! @ # $ % ^ * / \ ( ) ? . , &

Next Steps
You should now have the following files:

• Private key (privatekey.key) must always remain secure and should never be shared with others.
• CSR (CSR.csr) can be provided to GlobalSign to issue your certificate.

Both files can be opened using a standard plain‑text editor such as Notepad, TextEdit, Vi, Nano, or Notepad++.