How to Generate a CSR and Install a Commercial SSL Certificate

知識庫

If you've purchased an OV or EV certificate (or any certificate from a commercial Certificate Authority rather than Let's Encrypt), you'll need to generate a Certificate Signing Request (CSR) and install the certificate manually. This guide covers the full process.

What Is a CSR?

A Certificate Signing Request is a file containing your public key and organization details, submitted to a Certificate Authority so they can issue a certificate matching your domain and identity information.

Step 1 — Generate a Private Key and CSR

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.com.key -out yourdomain.com.csr

You'll be prompted for details:

Country Name: US
State: California
Locality: San Francisco
Organization Name: Your Company Inc
Organizational Unit: IT Department
Common Name: yourdomain.com
Email Address: [email protected]

Common Name must exactly match the domain the certificate will secure (e.g. yourdomain.com or www.yourdomain.com).

Step 2 — Keep the Private Key Secure

The .key file generated must never be shared with the Certificate Authority or anyone else — only the .csr file is submitted. Store the private key with restricted permissions:

chmod 600 yourdomain.com.key

Step 3 — Submit the CSR to Your Certificate Authority

Paste the contents of the .csr file into your CA's order form:

cat yourdomain.com.csr

Copy everything including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines.

Step 4 — Complete Domain/Organization Validation

Depending on certificate type (see Understanding SSL Certificate Types: DV vs OV vs EV), you'll need to complete domain control verification and, for OV/EV, provide business documentation as the CA requests.

Step 5 — Download the Issued Certificate Files

The CA will provide your certificate, typically along with an intermediate/chain certificate file — both are required for browsers to fully trust the certificate.

Step 6 — Install on Nginx

server {
    listen 443 ssl;
    server_name yourdomain.com;

    ssl_certificate /etc/ssl/certs/yourdomain.com.crt;
    ssl_certificate_key /etc/ssl/private/yourdomain.com.key;
    ssl_trusted_certificate /etc/ssl/certs/yourdomain.com-chain.crt;
}

If the CA provided separate certificate and intermediate files, combine them into one bundle in the correct order (your certificate first, then intermediates):

cat yourdomain.com.crt intermediate.crt > yourdomain.com-bundle.crt

Step 7 — Install on Apache

<VirtualHost *:443>
    ServerName yourdomain.com
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/yourdomain.com.crt
    SSLCertificateKeyFile /etc/ssl/private/yourdomain.com.key
    SSLCertificateChainFile /etc/ssl/certs/yourdomain.com-chain.crt
</VirtualHost>

Step 8 — Test and Reload

sudo nginx -t && sudo systemctl reload nginx

Step 9 — Verify Installation

echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Renewal Reminder

Unlike Let's Encrypt, commercial certificates don't auto-renew — set a calendar reminder well before the expiration date, since the process (CSR generation, CA verification, manual installation) takes real time to repeat.

Common Errors

"SSL certificate problem: unable to get local issuer certificate" — the intermediate/chain certificate wasn't installed alongside the main certificate; verify ssl_trusted_certificate (Nginx) or SSLCertificateChainFile (Apache) is correctly configured.

"Private key does not match certificate" — verify you're using the exact private key generated alongside the CSR that was submitted; a mismatched key/certificate pair will fail.

FAQ

Can I reuse an old private key for a renewal?
Technically possible but not recommended — generating a fresh key pair for each certificate is better security practice.

Continue Reading

Browse more articles in SSL/TLS & Certificates.

知識庫

分類

分類