2.5. Creating a private key and a CSR for a TLS client certificate by using OpenSSL

Procedure

1. Generate a private key on your client system, for example:

   $ openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-256 -out <client-private.key>

2. Optional: Use a text editor of your choice to prepare a configuration file that simplifies creating your CSR, for example:

   $ vi <example_client.cnf>
   [client-cert]
   keyUsage = critical, digitalSignature, keyEncipherment
   extendedKeyUsage = clientAuth
   subjectAltName = @alt_name
   
   [req]
   distinguished_name = dn
   prompt = no
   
   [dn]
   CN = <client.example.com>
   
   [clnt_alt_name]
   email= <client@example.com>

   The extendedKeyUsage = clientAuth option limits the use of a certificate.

3. Create a CSR using the private key you created previously:

   $ openssl req -key <client-private.key> -config <example_client.cnf> -new -out <client-cert.csr>

   If you omit the -config option, the req utility prompts you for additional information, for example:

   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   …
   Common Name (eg, your name or your server's hostname) []: <client.example.com>
   Email Address []: <client@example.com>

Verification

1. Check that the human-readable parts of the certificate match your requirements, for example:

   $ openssl x509 -text -noout -in <client-cert.crt>
   Certificate:
   …
               X509v3 Extended Key Usage:
                   TLS Web Client Authentication
               X509v3 Subject Alternative Name:
                   email:client@example.com
   …