meta/brands/meta_knowledgebase.title

If your website is hosted on a custom Linux server running Apache, Nginx, or Lighttpd without a web management panel (like cPanel or Plesk), you can easily generate a Certificate Signing Request (CSR) and Private Key using the command line via OpenSSL.

This step-by-step guide demonstrates how to generate your CSR via SSH terminal and submit it to the BuySSL.lk Client Area.

Step 1: Connect to Your Server via SSH

Open your terminal (Linux/macOS) or SSH client like PuTTY / Windows Terminal (Windows).
Connect to your server as a privileged user:

Bash

ssh root@your-server-ip

Step 2: Create a Secure Directory for SSL Files

Before generating the keys, navigate to a secure directory (or create a dedicated folder) to store your certificate files:

Bash 
mkdir -p /etc/ssl/my_certs
cd /etc/ssl/my_certs 

Step 3: Run the OpenSSL CSR Generation Command

Execute the following single OpenSSL command to generate both a 2048-bit Private Key and the CSR file simultaneously:

Bash 
openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr 

Replace yourdomain with your actual domain name for easy identification.

Command Breakdown:

openssl req: Calls the OpenSSL utility for certificate signing request management.
-new: Creates a new CSR request.
-newkey rsa:2048: Generates a new RSA Private Key with a secure length of 2048 bits.
-nodes: Creates the Private Key without password encryption. This allows Apache/Nginx to start automatically without requiring a password for the key.
-keyout: Specifies the output filename for your secret Private Key (.key).
-out: Specifies the output filename for your CSR (.csr).

Step 4: Enter Domain and Company Details

Once you press Enter, OpenSSL will prompt you to answer a series of questions. Provide the requested information:

Prompt Field	Description	Example
Country Name (2 letter code)	Your two-letter ISO country code.	`LK`
State or Province Name	Full state or province name (do not abbreviate).	`Western Province`
Locality Name (eg, city)	Full city name (do not abbreviate).	`Colombo`
Organization Name	Officially registered business name.	`Example Lanka Pvt Ltd`
Organizational Unit Name	Department or division name.	`IT Department`
Common Name (e.g. server FQDN)	Exact domain name to secure. (Crucial Field)	`example.com` or `*.example.com`

Extra Attributes:

A challenge password []: Leave this BLANK (Press Enter).
An optional company name []: Leave this BLANK (Press Enter).

Step 5: Display and Copy the CSR Code

Display the contents of the generated .csr file on your terminal screen:

Bash

cat yourdomain.csr
Highlight and copy the entire text block, including the header line -----BEGIN CERTIFICATE REQUEST----- and footer line -----END CERTIFICATE REQUEST-----.

Step 6: Submit the CSR in BuySSL Client Area

Log in to your BuySSL Client Area.
Go to Services > My Services and click on your active SSL certificate order.
Click Configure Certificate.
Select your web server type (e.g., Apache / Nginx / Linux) and paste the CSR text into the designated box.
Select your preferred Domain Validation (DCV) method and submit.

Pro-Tips & Important Notes:

Protect Your Private Key: Secure the file permissions of your Private Key file so only the root/system administrator can read it:

Bash

chmod 600 yourdomain.key

Never Lose the .key File: The generated yourdomain.key file stays on your server and is required when configuring Apache/Nginx later. Never send your Private Key to BuySSL or any third party.

Wildcard Certificates: If you are generating a CSR for a Wildcard SSL certificate, use a Common Name such as *.yourdomain.com. *.yourdomain.com.

Verify Your CSR: You can verify the details encoded inside your CSR before submitting by running:

Bash

openssl req -in yourdomain.csr -noout -text

How to Generate a Certificate Signing Request (CSR)" on Linux Server (Apache / Nginx) via SSH