Certificate Signing Request

lastmod 2018-09-06created 2015-11-294 edits

A kind of application form that encrypts the information of the company operating an SSL server and sends it to a certificate authority to have a certificate issued. A CSR is generated as an ASCII text file. When generating a CSR, you enter the server's distinguished name.

The distinguished name is a name that uniquely represents each server and includes the following information.

• Country Name (country code): ex. KR
• State or Province Name (region): ex. Seoul
• Locality Name (city/county/district): ex. Seocho
• Organization Name (company name): ex. Hanbiro Inc
• Organizational Unit Name (department name) ex. Linux Team
• Common Name (service domain name) ex. www.hanbiro.com
• Email Address

Description of CSR fields

• Country Name: This is the two-letter ISO country code.
• State or Province Name: Enter the city name; abbreviations are not allowed.
• Locality Name: This field can be omitted in most cases and indicates where the company is located.
• Organization: Enter the English company name that matches the company name on the business registration certificate.
• Organization Unit: You can enter the company's department, such as "Linux Admin Team" or "Windows Admin Team".
• Common Name: Enter the domain address to be certified.

Because this information identifies the web site, you must request a different digital ID if you change the host name. The client browser connecting to the host checks that the name in the digital ID matches the URL.

Caveats when entering CSR fields

• In Common Name, you must enter the exact domain name of the site where the certificate will be installed.
• Common Name cannot include an IP address, port number, path name, http:// or https://, etc.
• CSR fields cannot contain special 68 characters such as < > ~ ! @ # $ % ^ * / \ ( ) ?.
• After the CSR is generated, a private key (Private Key) is created on the server. If you delete or lose the private key, you cannot install the certificate even after it is issued. So be sure to back up the private key.
• For the two fields A challenge password and An optional company name that appear at the end of the information entry process in OpenSSL, do not enter anything; just press Enter to skip them. If these two are filled in, an invalid CSR may be generated.

Favorite site

• Wikipedia (en) Description of CSR
• Apache _ Creating a CSR and applying an SSL certificate - HanbiroSSL ¹

References