How to create a self-signed certificate in Linux

Creating a self-signed SSL certificate in Linux is fairly straightforward and can be done with just a few clicks. You can use a self-signed certificate to secure the connection between your web server and a visitor’s browser. Linux makes it very easy for you to generate a certificate and sign it with a private key.

Here’s how to create your own SSL certificates directly from your Linux terminal.

What is an SSL certificate?

SSL stands for Secure Socket Layer. An SSL certificate verifies the identity of a website and enables an encrypted (secure) connection between the website and your browser.

A secure connection will encrypt all data sent between your web browser and the server you are communicating with. This prevents any person or computer in the middle from intercepting and reading the transferred data.

Can I use a self-signed SSL certificate on my website?

You can install and use your own self-signed SSL certificate on your website and enable encrypted connections. However, because a trusted CA did not sign the certificate, visitors’ web browsers will display a warning that the site cannot be positively identified for this reason.

For this reason, self-signed certificates are generally best used for development and testing purposes, or for applications such as a corporate or home intranet where users come from an internal network and do not log in. via Internet.

Again, it’s important to note that although a self-signed SSL certificate can cause warnings in your web browser, it will still allow a secure connection that works exactly the same as any certificate created by any of the trusted authorities.

If you want to generate an SSL certificate for a public website but make sure that users don’t get confusing warnings, you might want to consider how to set up a free SSL certificate from a trusted CA.

Install OpenSSL on Linux

To generate a self-signed SSL certificate on Linux, you must first ensure that OpenSSL is installed. To do this, open a terminal and enter the appropriate commands corresponding to the distribution you are using.

If you are using a Debian-based system such as Ubuntu or Linux Mint:

sudo apt install openssl

If you are using an RPM-based distribution like Fedora or CentOS:

sudo dnf install openssl

To install OpenSSL on Arch Linux:

pacman -S openssl

It should take a few moments for your system to download and install the opening wrap.

Creating your self-signed SSL certificate

Once you have made sure you have OpenSSL installed, you can create your SSL certificate by entering a single command. OpenSSL will create the certificate and the corresponding encryption key in the current directory. So make sure you are in the directory where you want to save your certificate and key before entering any other commands.

To create your self-signed SSL certificate, enter the following command at the prompt, replacing the two instances of monserver with the file names you want to use.

openssl req -newkey rsa:4096 -x509 -sha256 -days 365 -nodes -out myserver.crt -keyout myserver.key

The command will generate a certificate and a private key used to sign the certificate. You can name the files as you want. The aforementioned command will generate a self-signed certificate using 4096-bit encryption, valid for 365 days.

To complete the process, the system will ask several questions about the organization the certificate is for. If you are just planning to use the certificate for personal development or testing, you can enter any values ​​you want except the Common name field. In this field, you must enter the domain name of the website where you plan to install the certificate.

Your SSL certificate is now ready for use

That’s all we can say about it. You should now have an SSL certificate (CRT file) and the encryption key (KEY file) used to sign it. Just follow the instructions on the platform you want to install your certificate on and you will be able to connect to your website using encrypted HTTPS connections.

Not many Linux users know this, but you can also use OpenSSL to encrypt files, entire disk directories, etc.

Read more

About the Author