OpenSSL

OpenSSL is a widely used library and toolkit for integrating encryption into products, like the Apache httpd server. Besides being a library somewhere in the system directory tree, it comes with a set of command-line tools to help you create and manage keys, certificate requests, certificates and revocations. The main tool is the command 'openssl' which if invoked with no other parameters, acts like a shell, allowing you to type in special OpenSSL commands to perform various operations.
There is a distinct and important relationship between keys and certificates. A certificate is a bunch of data that has been encrypted by a key. A key is some data that has been encrypted by a password. I can see the wheels turning and you're about to ask "why are we using a password to encrypt what is essentially another password? Why don't we just use our password and get rid of the key?" The truth is that people are terrible at creating passwords. Unless you use passwords like "0a4215ff7dc1ce10edc065233f4c07d8bc9330db1194b3648c97919a655cde288b0d6bd23329338b7ab2e6b1f2b42e727461a782a6757431d3e95c5812f759b6" then chances are, your passwords can be guessed using password crackers in a matter of seconds, probably in less than 1 second. The other truth is that computers are capable of generating keys that are mathematically superior to anything usable by a person. Computers aren't restricted to just letters, numbers and a few special characters. This allows computers to generate complex passwords that are more secure for use in cryptographic operations.
The keys and certificates are part of something called public key cryptography. This is similar to safety deposit boxes in bank vaults. When you get a vault box, there are 2 locks on the door. You are issued a key for one lock and the bank has its own key for the second lock. To open the door, you must have both keys. Now, let's extend this. You have a safe with 2 locks. The key to one of the locks you keep to yourself and never share it with anyone. This is your private key. For the other lock, you create a bunch of identical keys and share them with friends and family. These are public keys.
The process of getting a SSL certificate for use with a web site is simple:

• you generate a key
  
• using the key, you generate a certificate request (CSR) that contains data about the company and web site
  
• the CSR is sent to a Certificate Authority (CA) to be signed
  
• the CA signs the CSR, turning it into a certificate
  
• the certificate is returned and installed in the web server or SSL accelerator

Some important things to note about this process:

• a password is generally used to generate the key but this is not required
  
• the CA does not know nor do they require the password used to generate the key
  
• the certificate you are issued contains information about the CA who signed it
  
• each browser ships with the public key the CA, which is used to verify the information contained in the certificate

Keys

The first step in the process involves generating a key. There are, in general, three types of keys used, RSA, DSA and DH (Diffie-Hellman.) The most commonly used for SSL certificates are RSA keys. Additionally, keys can be of many sizes, specified in bits. The more bits in the key, the stronger the encryption it can afford you. You generate the key using the openssl shell. The 'genrsa' command is used for creating a RSA key. You can specify the encryption to be used to encrypt the key, a good algorithm is triple-DES or des3. You also need to specify an output file using the "-out" option, otherwise openssl will print the key to your screen. OpenSSL will prompt you for the password to use to encrypt the key.
Generating a key with a passphrase. The default key size is 512 bits:

$ openssl genrsa -des3 -out jeff.key
Generating RSA private key, 512 bit long modulus
.......++++++++++++
........................++++++++++++
e is 65537 (0x10001)
Enter pass phrase for jeff.key:
Verifying - Enter pass phrase for jeff.key:

In some cases, it is desirable to create a key that has no password. This also means the key is not encrypted, which has important security implications. If someone gets a hold of a key that has no password, they can use it to decrypt your certificate, which will allow them to read all the encrypted traffic. At OpSource, many SSL certificates are stored on the SSL accelerators built into the load balancers. Having the certificates on the load balancers requires having the key as well. Using a key with no password allows for easier installation on the load balancers. To generate a key with no password, simply leave out any encryption options. In the following example, we specified a key size of 1024 bits.
Generating a key with no passphrase:

$ openssl genrsa -out jeff.key 1024
Generating RSA private key, 1024 bit long modulus
.......................++++++
.........++++++
e is 65537 (0x10001)

The remaining examples use existing keys are using one that has no password. If you use a key that has a password, then you will be prompted to enter that password at the beginning of the listed process because the key needs to be decrypted before any other processing can take place.

Certificate Requests

As mentioned, the second part of the process is to generate a certificate request (CSR). The CSR will contains various pieces of information about the company as well as the hostname of the site. When creating a CSR, you can either use a pre-existing key or you can generate a new one as part of the process. A single key can be used for multiple CSRs. The most important part of the CSR is the Common Name. This must match the hostname for the site as used in URLs. If it does not, then browsers will display a security error to the end user, saying that the hostname in the URL does not match the name in the certificate. The exception to this rule is what's known as a wildcard certificate. A wildcard certificate is used for subdomains of a site. For example, a site that uses the following URLs:

• testing.app.company.com
  
• qa.app.company.com
  
• www.app.company.com

can all be secured with a wildcard certificate. To generate a CSR for a wildcard certificate, you need to prepend a *. to the hostname in the Common Name field. Using the example above, the Common Name would be *.app.company.com.
The OpenSSL command for generating a certificate request is the 'req' command. Additionally, since you'll be generating a new request, you need to add the "-new" option, otherwise, it'll expect you to provide an existing request. As before, you need to use the "-out" option and a file name or the CSR will be printed to your screen.
Generating a certificate request using an existing key:

$ openssl req -new -key jeff.key -out jeff.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

----
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:Virginia
Locality Name (eg, city) [Newbury]:Herndon
Organization Name (eg, company) [My Company Ltd]:OpSource Inc.
Organizational Unit Name (eg, section) []:Operations
Common Name (eg, your name or your server's hostname) []:www.someserver.com
Email Address []:client@opsource.net

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

The resulting file can be sent to a Certificate Authority for signing. They will then issue a certificate that can be installed in the web server or a load balancer. Remember, the key needs to be matched with the certificate so when submitting the certificate to your system administrator, remember to give them the key as well.

Self-signed Certificates

Certificate Authorities charge money for each certificate they sign. Costs can range from $150 for a single certificate good for 1 year to over $1,000 for a single certificate good for 5 years. Wildcard certificates generally cost much more. So what happens when you have a site that doesn't require a valid certificate, such as a development site or a QA site. These types of environments are generally not public-facing and don't require a valid certificate signed by a CA. In those cases, you can generate a self-signed certificate. This is a certificate that has been signed by itself and not a CA. These certificates will always generate an error in the browser. The process of generating them is similar in that you need a key (either pre-existing or generated during the process) and you generate a request but you then use OpenSSL commands designed for certificate management to sign the certificate. Generating the request and signing it are easily done at the same time. The specific OpenSSL options for this are the "-x509" option and the "-days" option, which allows you to specify how long the certificate is valid for.
Generating a self-signed certificate using an existing key:

$ openssl req -new -key jeff.key -x509 -days 365 -out jeff-selfsigned.crt
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:Virginia
Locality Name (eg, city) [Newbury]:Herndon
Organization Name (eg, company) [My Company Ltd]:OpSource Inc.
Organizational Unit Name (eg, section) []:Operations
Common Name (eg, your name or your server's hostname) []:www.someserver.com
Email Address []:client@opsource.net

This process can be shorten even further. This command performs everything necessary, from generating a 1024-bit key to the final certificate ready to be used. The "-nodes" tells OpenSSL to generate a key with no encryption and the "-keyout" is to tell OpenSSL what file to write the key to.
Generating a self-signed certificate and a new key that has no passphrase:

$ openssl req -newkey rsa:1024 -nodes -keyout jeff.key -x509 -days 365 -out jeff-selfsigned.crt
Generating a 1024 bit RSA private key
......................................++++++
...................................++++++
writing new private key to 'jeff.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:Virginia
Locality Name (eg, city) [Newbury]:Herndon
Organization Name (eg, company) [My Company Ltd]:OpSource Inc.
Organizational Unit Name (eg, section) []:Operations
Common Name (eg, your name or your server's hostname) []:www.someserver.com
Email Address []:client@opsource.net

Summary

The OpenSSL toolkit is a powerful combination of libraries and commands. The libraries allow developers to add strong encryption to products while the commands allow administrators to generate and manage keys, certificate requests and certificates. You can even establish a Certificate Authority with the OpenSSL toolkit, though there are some very important logistics surrounding physical, computer and network security, as well as management of certificates make this difficult to do properly.
The process of obtaining a SSL certificate for use with web sites is simple. The commands are few but the responsible handling of resulting keys, certificates and passwords are important and proper care needs to be exercised.