Generating CSR and Private Key through OpenSSL

Last Updated : Jul 16, 2026 |
Prolog information
Metadata
Keywords:
Use this procedure to replace the Security Module SIP identity certificate. You can replace other identity certificates similarly.
  1. Log in to Session Manager CLI with cust credentials.
  2. Copy and modify the default OpenSSL configuration file to a cust directory by typing: cp /etc/pki/tls/openssl.cnf /home/cust/openssl_csr.cnf.
  3. Edit the configuration file by typing: vi /home/cust/openssl_csr.cnf.
    ADDITIONAL INFORMATION:
    You must edit the configuration file to meet the certificate attributes required for each Identity Certificate.
  4. Edit the following list of certificate attributes with the values assigned.
    ADDITIONAL INFORMATION:
    • default_md= sha256
    • req_extensions = v3_req # The extensions to add to a certificate request
    • keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
    • extendedKeyUsage=serverAuth, clientAuth
    • subjectAltName= @alt_names
    • DNS.1 = example.com # The Session Manager SIP domain
    • DNS.2 = sip.example.com # Another Session Manager SIP domain
    • IP = 192.168.1.100 # The Session Manager SIP interface (eth1) IP address
    • URI.1 = sip:example.com # The Session Manager SIP domain preceded by the sip schema
    • URI.2 = sip:sip.example.com # Another Session Manager SIP domain preceded by the sip schema
    The following example shows a configuration file of Security Module SIP identity certificate that meets the Security Module SIP Identity Certificate attributes.
    [ req ]
    default_bits            = 2048
    default_md              = sha256
    default_keyfile         = privkey.pem
    distinguished_name      = req_distinguished_name
    attributes              = req_attributes
    x509_extensions = v3_ca # The extentions to add to the self signed cert
    …
    # WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
    string_mask = utf8only

    req_extensions = v3_req # The extensions to add to a certificate request

    …
    [ v3_req ]

    # Extensions to add to a certificate request

    basicConstraints = CA:FALSE
    keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
    extendedKeyUsage=serverAuth, clientAuth
    subjectAltName= @alt_names

    [alt_names]
    DNS.1 = example.com              # The Session Manager SIP domain
    DNS.2 = sip.example.com          # Another Session Manager SIP domain
    IP = 192.168.1.100               # The Session Manager SIP interface (eth1) IP address
    URI.1 = sip:example.com          # The Session Manager SIP domain preceded by the sip schema
    URI.2 = sip:sip.example.com      # Another Session Manager SIP domain preceded by the sip schema
    …
    Note:
    Some public CAs do not allow signing a CSR with a Subject Alternative Name extension entry of type URI and sip scheme, for instance URI=sip:sip.example.com. In such cases, use only the DNS type entry with the corresponding SIP Domain. In the above example, remove the lines that start with URI.1 and URI.2
  5. Type openssl req -out asm1.csr -new -newkey rsa:2048 -keyout asm1.key -config /home/cust/openssl_csr.cnf.
    ADDITIONAL INFORMATION:
    The following example shows the system output for this command:
    $ openssl req -out asm1.csr -new -newkey rsa:2048 -keyout asm1.key -config /home/cust/openssl_csr.cnf
    Generating a 2048 bit RSA private key
    ....+++
    .............................................+++
    writing new private key to 'asm1.key'
    Enter PEM pass phrase:     <<< Private key pass phrase
    Verifying - Enter PEM pass phrase:
    -----
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [XX]:US
    State or Province Name (full name) []:CO
    Locality Name (eg, city) [Default City]:Thornton
    Organization Name (eg, company) [Default Company Ltd]:My example company
    Organizational Unit Name (eg, section) []:IT
    Common Name (eg, your name or your server's hostname) []:asm1.example.com   <<< Session Manager hostname
    Email Address []:

    Please enter the following 'extra' attributes
    to be sent with your certificate request
    A challenge password []:
    An optional company name []:
    STEP RESULT:
    The system generates the CSR and private key. The generated CSR file is asm1.csr and the private key is asm1.key. The private key is protected with a pass phrase to be used at the prompt when the private key is generated. This pass phrase is used to create the PKCS#12 container.
    The private key file must stay on the server always and must not be tampered with. If the private key is compromised, it could potentially decrypt TLS traffic or impersonate Session Manager.
  6. To view and verify the attributes of the CSR file asm1.csr, type openssl req -in asm1.csr -text.
    ADDITIONAL INFORMATION:
    The system displays the following output:

    Certificate Request:
        Data:
            Version: 0 (0x0)
            Subject: C=US, ST=CO, L=Thornton, O=My example company, OU=IT, CN=asm1.example.com
            Subject Public Key Info:
                Public Key Algorithm: rsaEncryption
                    Public-Key: (2048 bit)
                    Modulus:
                        00:f2:d7:35:5a:f9:f7:9f:5f:1e:9e:f5:e0:4f:…
                    Exponent: 65537 (0x10001)
            Attributes:
            Requested Extensions:
                X509v3 Basic Constraints:
                    CA:FALSE
                X509v3 Key Usage:
                    Digital Signature, Non Repudiation, Key Encipherment, Key Agreement
                X509v3 Extended Key Usage:
                    TLS Web Server Authentication, TLS Web Client Authentication
                X509v3 Subject Alternative Name:
                    DNS:example.com, DNS:sip.example.com, IP Address:192.168.1.100, URI:sip:example.com, URI:sip:sip.example.com
        Signature Algorithm: sha256WithRSAEncryption
             1f:64:2a:92:89:ce:bd:ff:80:7a:c8:50:7b:f2:bd:80:57:ce:…
    -----BEGIN CERTIFICATE REQUEST-----
    MIIDWDCCAkACAQAwcjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNPMREwDwYD…
    -----END CERTIFICATE REQUEST-----
  7. Send the CSR file asm1.csr to the PKI administrator to get signature of the third-party CA.
    ADDITIONAL INFORMATION:
    The result is a signed identity certificate.
Related links
Checklist for generating certificate signing request (CSR)