Generar un fichero CSR (petición de firmado)

Al pedir un certificado a cualquier entidad certificadora nos pide que les demos un CSR (Certificate Signing Request) que deberemos generar. Vamos a ver los pasos:

Primero de todo deberemos generar la clave privada, para ello podemos usar openssl con la opción genrsa:

$ openssl genrsa -out privkey.pem 2048
Generating RSA private key, 2048 bit long modulus
..............+++
......................................+++
e is 65537 (0x10001)

A continuación deberemos generar la petición de firmado a partir de la clave privada (que deberemos conservar en secreto). Para ello podemos usar openssl con la opción req y rellenar los campos. Estos

$ openssl req -new -key privkey.pem -out cert.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:ES
State or Province Name (full name) []:Barcelona
Locality Name (eg, city) [Default City]:Barcelona
Organization Name (eg, company) [Default Company Ltd]:systemadmin.es
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:secure.systemadmin.es
Email Address []:info@systemadmin.es

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

La información adicional que rellenamos es la que la entidad certificadora comprueba y que luego aparece en el certificado:

Certificado con Green Bar

Otro ejemplo:

Información del certificado

El fichero CSR que se generará será como el siguiente:

$ cat cert.csr 
-----BEGIN CERTIFICATE REQUEST-----
eERERCDyG3NReTCMYXBC4yNeGZDan5xLvNvPX8unODVl3CjwXLTz02GAmMJzLDgI
fVETrFUVYqBZdnou2ic9ghD5470QwasEQr/+0p7fk2QFzUgwOdlSY6FK8qXCGwQI
mJ3wIYvkUFQ2O1j/67gLnpUdSUhPC527MoxR4yliRSNfSXFXJuRRIf4Y1Qy9+YOL
rNY2HmTj0vf9YyURnqJ1FHBkeoD2P3/pbIVNe6tMWreX+L0Osau+LR/pzTG49PNo
pe5jyysFyfi0TKOptx2tbIdkhTP9swNxA7pRx72KrJU3OhaX+e2qzvRNWeh7BgKD
herWqMong+iNmGoxI6SYETgDysCVoij4D3yMRsC7khkoz7m/PqXek3yPJu/Ji+Ra
NNWCj5FDRVSxxmRcpjr09YjjEmS++lDOo+tRI2N2KXGOyH2BTy96b/V2F7EdKi7S
DEV/c0ePVUfK19JM+oLyH75lMISGm0mLj7XlL5B547aXBt9fu0NbVD4GCN/H3MqF
+GGFN7yrDxM7Yc0e/i6c8vvUKHngMw0UQkibrZuVO7EjH6obQ6eQ78YadSWOBnkT
EAzNuWBVLNTO7zaYPL0h6bsi6KrMhAxSh0LpRDUB5r1YTfGMeG8Odi67MSpv6D4u
oAreiBjR00BuPkxU6KOFaYCj6GPTaMtWlGHMvBg+kVk8gnpHDeuGNYjPp5+7SiZM
eIvqriOGgeaQG96IOo2fMpqcWAZSoKAWelD//aV2k752zuQbck9HtVuvn0+zhfET
/sFF1yHmDL4t2PvxBZ7YVlwTAYnX/bqJ2QRxIcYm3uUTiNPYJ6Xa5v7ObqDn6A83
qzzUmANBjiEn3OvYdvX/Oy9MIFA0Fh9Zo4ZeOFGwaOOm+jU0p+7j6OdDww+Ca1wh
enV0fhUOtFMOUWlHkT4QZ5DZkctV7+4pk8+rm+HRp1QukhZNKEw7IrZC/C8u3ASl
0wlta8zPb6pXyTnMz3M0YNLnLicvyF3UzzUty11UCg==
-----END CERTIFICATE REQUEST-----

Este deberemos entregarlo a la entidad certificadora para que lo firme. En el caso que queramos consultar los datos de un CSR lo podemos hacer con la opción asn1parse de openssl:

$ openssl asn1parse -in cert.csr 
    0:d=0  hl=4 l= 747 cons: SEQUENCE          
    4:d=1  hl=4 l= 467 cons: SEQUENCE          
    8:d=2  hl=2 l=   1 prim: INTEGER           :00
   11:d=2  hl=3 l= 165 cons: SEQUENCE          
   14:d=3  hl=2 l=  11 cons: SET               
   16:d=4  hl=2 l=   9 cons: SEQUENCE          
   18:d=5  hl=2 l=   3 prim: OBJECT            :countryName
   23:d=5  hl=2 l=   2 prim: PRINTABLESTRING   :ES
   27:d=3  hl=2 l=  18 cons: SET               
   29:d=4  hl=2 l=  16 cons: SEQUENCE          
   31:d=5  hl=2 l=   3 prim: OBJECT            :stateOrProvinceName
   36:d=5  hl=2 l=   9 prim: UTF8STRING        :Barcelona
   47:d=3  hl=2 l=  30 cons: SET               
   49:d=4  hl=2 l=  28 cons: SEQUENCE          
   51:d=5  hl=2 l=   3 prim: OBJECT            :localityName
   56:d=5  hl=2 l=  21 prim: UTF8STRING        :Barcelona
   79:d=3  hl=2 l=  35 cons: SET               
   81:d=4  hl=2 l=  33 cons: SEQUENCE          
   83:d=5  hl=2 l=   3 prim: OBJECT            :organizationName
   88:d=5  hl=2 l=  26 prim: UTF8STRING        :systemadmin.es
  116:d=3  hl=2 l=  27 cons: SET               
  118:d=4  hl=2 l=  25 cons: SEQUENCE          
  120:d=5  hl=2 l=   3 prim: OBJECT            :commonName
  125:d=5  hl=2 l=  18 prim: UTF8STRING        :secure.systemadmin.es
  145:d=3  hl=2 l=  32 cons: SET               
  147:d=4  hl=2 l=  30 cons: SEQUENCE          
  149:d=5  hl=2 l=   9 prim: OBJECT            :emailAddress
  160:d=5  hl=2 l=  17 prim: IA5STRING         :info@systemadmin.es
  179:d=2  hl=4 l= 290 cons: SEQUENCE          
  183:d=3  hl=2 l=  13 cons: SEQUENCE          
  185:d=4  hl=2 l=   9 prim: OBJECT            :rsaEncryption
  196:d=4  hl=2 l=   0 prim: NULL              
  198:d=3  hl=4 l= 271 prim: BIT STRING        
  473:d=2  hl=2 l=   0 cons: cont [ 0 ]        
  475:d=1  hl=2 l=  13 cons: SEQUENCE          
  477:d=2  hl=2 l=   9 prim: OBJECT            :sha1WithRSAEncryption
  488:d=2  hl=2 l=   0 prim: NULL              
  490:d=1  hl=4 l= 257 prim: BIT STRING