Generating an Unencrypted Private Key and Self-Signed Public Certificate

This article discusses how to generate an unencrypted private key and public certificate pair that is suitable for use with HTTPS, FTPS, and the administrative port for EFT Server. (To generate an encrypted key/certificate pair, refer to Generating an Encrypted Private Key and Self-Signed Public Certificate.)

General Information

Each of the above combinations uses RSA key exchange; therefore, RSA-based key/certificates must be used.

Procedure

These instructions assume you have downloaded and installed the Windows binary distribution of OpenSSL. Refer to Using OpenSSL for the basic instructions.

  1. Generate an RSA private key:

  2. >C:\Openssl\bin\openssl.exe genrsa -out <Key Filename> <Key Size>

    Where:

    For example, type:

    >C:\Openssl\bin\openssl.exe genrsa -out my_key.key 2048

  3. Generate a Certificate Signing Request:

  4. In version 0.9.8g:

    >C:\Openssl\bin\openssl.exe req -new -key <Key Filename> -out <Request Filename> -config C:\Openssl\bin\openssl.cnf

    -OR-

    In version 0.9.8h and later:

    >C:\Openssl\bin\openssl.exe req -new -key <Key Filename> -out <Request Filename> -config C:\Openssl\bin\openssl.cfg

    Where:

    For example, type:

    >C:\Openssl\bin\openssl.exe req -new -key my_key.key -out my_request.csr -config C:\Openssl\bin\openssl.cnf

  5. Follow the on-screen prompts for the required certificate request information.

  6. Generate a self-signed public certificate based on the request

  7. >C:\Openssl\bin\openssl.exe x509 -req -days 3650 -in <Request Filename> -signkey <Key Filename> -out <Certificate Filename>

    Where:

    For example, type:

    >C:\Openssl\bin\openssl.exe x509 -req -days 3650 -in my_request.csr -signkey my_key.key -out my_cert.crt

  8. (Optional) You may now delete the request file, as it is no longer needed.

The resulting private key file and public certificate file can now be used within EFT Server.