Creating a web certificate

Run the following command:

• openssl genrsa -out /etc/certs/openxpki_democa/web-1.key -passout file:/etc/certs/openxpki_democa/pd.pass 4096

Replace the subject in the request with your CA information using openssl req -config /etc/certs/openxpki_democa/openssl.conf -reqexts v3_web_reqexts -new -key /etc/certs/openxpki_democa/web-1.key -subj /DC=COM/DC=LEXMARK/DC=DEV/DC=CA-ONE/CN=FQDN of your system -out /etc/certs/openxpki_democa/web-1.csr.

Run the following command:

• openssl x509 -req -extfile /etc/certs/openxpki_democa/openssl.conf -extensions v3_web_extensions -days 900 -in /etc/certs/openxpki_democa/web-1.csr -CA /etc/certs/openxpki_democa/ca-signer-1.crt -CAkey /etc/certs/openxpki_democa/ca-signer-1.key -CAcreateserial -out /etc/certs/openxpki_democa/web-1.crt -sha256