> ## Content Index
> Fetch the complete content index at: https://www.bagz.fr/llms.txt
> Use this file to discover other available public pages before exploring further.

# Generate self-generated SSL certificate (cert/key pair)
- URL: https://www.bagz.fr/generate-self-generated-ssl-certificate-certkey-pair/
- Published: 2017-07-05T20:02:38.000Z
- Updated: 2017-07-05T20:02:38.000Z
- Author: bgazui
- Tags: Linux, #Migrated-1790668826633, #wp, #wp-post, #Import 2026-09-29 08:00

Here is a simple script with configuration file to generate a self-generated SSL certificate (cert/key pair).

First define a config file **openssl.cnf** containing the certificate informations:

\[ req \]  
default\_bits = 2048  
encrypt\_key = yes  
distinguished\_name = req\_dn  
x509\_extensions = cert\_type  
prompt = no  
  
\[ req\_dn \]  
\# country (2 letter code)  
C=FR  
  
\# State or Province Name (full name)  
ST=IdF  
  
\# Locality Name (eg. city)  
L=Paris  
  
\# Organization (eg. company)  
O=MyOrg  
  
\# Organizational Unit Name (eg. section)  
OU=My SSL server  
  
\# Common Name (\*.example.com is also possible)  
CN=my.domain.com  
  
\# E-mail contact  
emailAddress=postmaster@domain.com  
  
\[ cert\_type \]  
nsCertType = server  

Then, create the bash script **makessl.sh** and configure your own parameters (directories, cert filename and validity duration):

#!/bin/sh  
  
\# Generates a self-signed certificate.  
\# Edit openssl.cnf before running this.  
  
umask 077  
OPENSSL=${OPENSSL-openssl}  
  
\# Define SSL directory  
SSLDIR=${SSLDIR-/opt}  
\# Define SSL config file  
OPENSSLCONFIG=${OPENSSLCONFIG-/opt/openssl.cnf}  
\# Define crt/key directories  
CERTDIR=$SSLDIR/certs  
KEYDIR=$SSLDIR/private  
\# Define crt/key file  
CERTFILE=$CERTDIR/mynewssl.pem  
KEYFILE=$KEYDIR/mynewssl.key  
\# Define validity duratin for the cert  
DAYS=365  
  
\# Check that directories exist or create themt  
if \[ ! -d $CERTDIR \]; then  
 mkdir -p $CERTDIR  
fi  
if \[ ! -d $KEYDIR \]; then  
 mkdir -p $KEYDIR  
fi  
  
\# Check that the files do not exist or move them  
if \[ -f $CERTFILE \]; then  
 mv $CERTFILE $CERTFILE.old  
fi  
if \[ -f $KEYFILE \]; then  
 mv $KEYFILE $KEYFILE.old  
fi  
  
\# Generate crt/key files  
$OPENSSL req -new -x509 -nodes -config $OPENSSLCONFIG -out $CERTFILE -keyout $KEYFILE -days $DAYS || exit 2  
chmod 0600 $KEYFILE  
echo  
$OPENSSL x509 -subject -fingerprint -noout -in $CERTFILE || exit 2  

Now, execute the bash script:

$ bash makessl.sh  
Generating a 2048 bit RSA private key  
...............+++  
................................................................................+++  
writing new private key to '/opt/private/mynewssl.key'  
\-----  
  
subject= /C=FR/ST=IdF/L=Paris/O=MyOrg/OU=My SSL server/CN=my.domain.com/emailAddress=postmaster@domain.com  
SHA1 Fingerprint=F0:B1:B3:DF:F9:4D:A0:97:4E:71:E0:7F:8E:DA:13:F9:D5:E8:AF:88  

Let's check your freshly created certificate and double check the information:

$ openssl x509 -in /opt/certs/mynewssl.pem -noout -dates -subject  
notBefore=Jul 5 19:45:17 2017 GMT  
notAfter=Jul 5 19:45:17 2018 GMT  
subject= /C=FR/ST=IdF/L=Paris/O=MyOrg/OU=My SSL server/CN=my.domain.com/emailAddress=postmaster@domain.com