What does openssl req -newkey rsa:4096 -nodes -sha256 -keyout www-private.key -out www.csr -config request.conf produce, and why does -nodes matter for file permissions?
It generates a new 4096-bit RSA key pair (saved unencrypted as www-private.key) and a CSR (www.csr) that carries the public key plus the requested name and extensions, signed with the private key.
Two outputs, three components:
- The private key (
www-private.key), written in/etc/ssl/private/. It never leaves the server. - The public key, which is not a separate file here: it is embedded in the CSR.
- The Certificate Signing Request (
www.csr): the public key, the subject from the config (CN=www.gXXX.ckteck.com, O=CKTECK, C=CH …), the requested extensions (Key Usage,extendedKeyUsage = serverAuth, Subject Alternative Name), all signed with the private key.
-sha256 picks the hash for the CSR's signature; -config supplies the subject and extensions so nothing has to be typed interactively.
-nodes ("no DES") stores the private key unencrypted. Without it OpenSSL asks for a passphrase, and Apache would then prompt for it on every start, so the server could not reboot unattended. The price is that anyone who can read the file has the server's identity. File permissions become the only protection: the key must be readable by root alone (chmod 600, in the root-only /etc/ssl/private/).
Go deeper:
Wikipedia: Certificate signing request — structure and an OpenSSL example.- RFC 2986: PKCS #10 Certification Request Syntax — the standard format of the request.