How to create wildcard certificates using config files

create_wildcard_cert_using_config.md

How to create a self-signed certificate request for a domain and all its subdomains with OpenSSL.

The configuration file

The certificate.conf can be used to create a configuration for a certificate. Its content can look as follows:

[req]
default_bits = 2048
default_md = sha256
prompt = no                                   # configuration for openssl command to not prompt, it will take req_distinguished_name instead
distinguished_name = req_distinguished_name   # the information required to generate a self-signed certificate
req_extensions = v3_req                       # (optional) the extensions to add to a certificate request; v3_req defines the name of the new section

[req_distinguished_name]
C = DE                                  # country
ST = Berlin                             # state or province
L = Berlin                              # locality
O = Company Name                        # organization
OU = Unit                               # organizational unit 
CN = *.your-domain.com                  # common name, the domain name
emailAddress = mail@your-domain.com     # e-mail address  

[v3_req]
basicConstraints = CA:TRUE              # is the certificate a certificate authority (CA)
subjectAltName = @alt_names             # allows one or multiple DNS, IP, URI, and more; @alt_names defines the name of the new section

[alt_names]
DNS.0 = *.your-domain.com
# (optional) IP.1 = 147.14.51.165

OpenSSL command

The command used to create a CSR with the above defined config template openssl req -nodes -new -newkey rsa:2048 -sha256 -keyout self-cert.key -out self-cert.csr -config certificate.conf

command	description
req	PKCS#10 X.509 Certificate Signing Request CSR Management
-nodes	don't encrypt the output key
-new	new request
-newkey rsa:bits	generate a new RSA key of 'bits' in size
-sha256	Digest to sign with sha256
-keyout self-cert.key	file to send the key to
-out self-cert.csr	output file
-config certificate.conf	request template file, configuration file

For reference, see openssl req --help.