---
type: source
title: "Zertifikat mit OpenSSL"
tags: [openssl, pki, server-certificates, university-greifswald]
related: [openssl, serverzertifikate, ec-keys, rsa-keys, certificate-signing-request]
created: 2026-06-30
updated: 2026-06-30
sources: ["output/rz_uni_greifswald_de_dienste_allgemein_dfn_pki_zertifikate_serverzertifikate_ope.md"]
---

# Zertifikat mit OpenSSL

This source provides technical instructions for creating a private key and a Certificate Signing Request (CSR) using OpenSSL for server certificates at the Universität Greifswald.

## Key Technical Instructions

### Key Generation
The document provides two primary methods for generating keys:
- **Elliptic Curve (EC) Keys**: Recommended for modern use.
  - Command: `openssl req -new -key <(openssl ecparam -name secp384r1 -genkey | tee hostname_key.pem) -out hostname_request.pem`
  - Optional compression: `openssl ec -in hostname_key.pem -out hostname_key.pem`
- **RSA Keys**: Used as a fallback or for specific requirements.
  - Command: `openssl req -newkey rsa:4096 -keyout hostname_key.pem -out hostname_request.pem -nodes`

### CSR Parameter Requirements
When generating the request, the following values must be used:
- **Country**: DE
- **State/Province**: Mecklenburg-Vorpommern
- **Locality**: Greifswald
- **Organization**: `Universitaet Greifswald` (Strict spelling required)
- **Common Name**: The DNS name of the server
- **Email Address**: The applicant's email address

## Critical Constraints
- **Key Encipherment**: If a certificate requires "Key Encipherment" (specifically required for [[shibboleth]]), EC certificates are technically impossible. In these cases, **RSA certificates must be used**.
