How Do I Create a Self-Signed Certificate?
This guide explains how to create a self-signed certificate using OpenSSL, including generating a key pair, creating a certificate signing request (CSR), self-signing the certificate, and optionally exporting it in PKCS#12 format.
Prerequisite: OpenSSL must be installed on the system. OpenSSL is commonly pre-installed on Linux and macOS. Windows users may need to install it separately.
1. Generate Key and CSR
Generate a private key and a Certificate Signing Request (CSR), which will be used to create the self-signed certificate.
Option A: Basic Subject
openssl req -new -newkey rsa:3072 -nodes \
-rand /dev/urandom \
-keyout mycert.key \
-out mycert.csr \
-sha256 \
-subj '/CN=ais.company.ch/C=CH'
Option B: Include Organization or Organizational Unit (Optional)
Optionally include Organization (O) and Organizational Unit (OU) information in the certificate subject.
openssl req -new -newkey rsa:3072 -nodes \
-rand /dev/urandom \
-keyout mycert.key \
-out mycert.csr \
-sha256 \
-subj '/CN=ais.company.ch/O=Company/OU=OrganizationalUnit/C=CH'
2. Self-Sign and Create Certificate
openssl x509 -req \
-days 1095 \
-sha256 \
-in mycert.csr \
-signkey mycert.key \
-out mycert.crt
3. Convert to PKCS#12 (Optional)
Convert the certificate and private key to PKCS#12 format if a password-protected certificate bundle (.p12) is required by your application or platform.
openssl pkcs12 -export \
-in mycert.crt \
-inkey mycert.key \
-out mycert.p12
Provide mycert.crt to Swisscom Trust Services and store the private key securely.