If you want to learn how to create a CRT file on Linux to check certificate validity during the testing phase or for internal usage, you have come to the right place. Continue reading the article to find out more.
A security certificate file with the .crt extension is a certificate that websites use to build a secure connection with the server. This certificate allows websites to send sensitive data over the internet. Sensitive data may include user credentials, payment details, bank transactions, etc.
In this article, we will explain how to create self-signed CRT certificates using the OpenSSL tool in Linux. So, let’s get started.
Difference Between Self-Signed Certificates and CA-Signed Certificates
A self-signed certificate is a certificate signed by the user itself. On the other hand, the CA Signed Certificate is signed by an external authority, and web browsers trust the certificate signed by an external authority. This is because those certificates are verified by the authorities such as Letsencrypt, DigiCert, and Globalsign.
On the other hand, the signing authorities do not verify self-signed certificates. Therefore, the clients do not trust certificates. However, using the self-signed certificate for development and testing purposes is acceptable.
For this tutorial, ensure that you have the OpenSSL tool installed on your Linux machine. In addition, this tutorial requires root access or the sudo privilege to your account.
How to Create a CRT File on Linux
This tutorial will first cover CRT certificate generation. Then we will discuss how to use it in Linux.
Verify the OpenSSL Version
First, open the terminal by pressing “Ctrl + Alt + T”. Check for the OpenSSL version by typing the command given below:
You should get a similar output:
In case, if the OpenSSL tool does not exist, install it by executing the command given below:
sudo apt-get update -qq sudo apt-get install -y openssl
Generate an RSA Private Key File
Now that OpenSSL exists in the system, we will generate a private key. To generate the private key on your Linux machine using the OpenSSL command. Specifically, type:
openssl genrsa -out private.key openssl genrsa -des3 -passout pass:x -out keypair.key 2048
The output should look something like this:
From the output, it is clear the machine has generated a private SSL key using the RSA algorithm.
Create a Certificate Signing Request (CRS) File
In this step, we will use the generated certificate file and turn it into a CRT file. For this step, we will add the .crt extension.
openssl req -new -key private.key -out request.csr
The command will prompt you to enter information such as country name, state, etc. Press the “Enter” key to skip entering the information. However, it is better to provide the correct information in this process. It should look something like this:
Once you have generated the .csr file, you can check it by executing the command given below:
Create a CRT Certificate on Linux
Now, to create the CRT certificate using the .crt file, execute the command given below:
openssl x509 -req -days 365 -in request.csr -signkey private.key -out certificate.crt
The output should look something like this:
Verify the CRT File on Linux
To check whether the file has been created successfully or not, use the
cat command. For example, type:
The output should show the certificate content:
Alternatively, use the
find command to find the file. If the file exists, it will appear. Specifically, type:
find -name certificate.crt -print
In addition, you can also use the
locate command as shown below:
locate certificate.crt > cat certificate.crt
Finally, you have successfully generated the CRT certificate. Make sure to back up the key to external storage to keep it safe.
Configure the Server to Use the Certificate Files
Now that we’ve created the certificate, we can now test it on the server. For this process, first, we will install the
mod_ssl package. Specifically, input:
sudo yum install mod_ssl
Wait for the installation to complete. After that, place the
ssl.conf file in the
/etc/httpd/conf.d/ directory. After that, open the file using your preferred text editor:
#vim editor sudo vi /etc/httpd/conf.d/ssl.conf #nano sudo nano /etc/httpd/conf.d/ssl.conf
Scroll down until you find the following line:
Update the path with the path to your certificate file. Press “Ctrl + S” to save and exit the editor. Now, restart the Apache server using the
sudo apachectl restart
Now, the next time you connect to your IP Address via HTTPS, you will get a warning that your certificate is not trusted.
And you’re done! When Apache restarts, it will be configured to allow SSL connections by using the generated self-signed SSL certificates.
In this article, we have looked at the certificate (.crt), and private key (.key) files that we use for setting up an HTTPS server that is essential for setting up an HTTPS server. In addition, we also discussed the difference between certificates signed by an external authority and self-signed certificates.
Lastly, we generated the CRT certificates and used them with the Apache server.
If this article helped you, please share it.