---
title: "Creating CSR files from the command line"
date: "2024-02-14T06:18:38+00:00"
summary: "Generate a CSR file from the command line with our step-by-step guide. Learn how to create, configure, and verify Certificate Signing Requests for secure SSL implementation on your web infrastructure."
image:
type: "page"
url: "/acquia-cloud-platform/creating-csr-files-command-line"
id: "b5f58b31-dc69-4f3f-8abe-46518f3825e7"
---

A [Certificate Signing Request](https://en.wikipedia.org/wiki/Certificate_signing_request) (CSR) file is a block of encrypted text that is generated on the infrastructure that the certificate will be used on. It has information that will be included in your SSL certificate, such as your organization name, common name (domain name), locality, and country. You can’t create an SSL certificate without first generating a CSR file.

Recommended method

CSRs generated from the command line are neither managed nor displayed on the Cloud Platform interface’s SSL page. For information on creating CSRs by using the SSL Setup wizard in Cloud Platform, see [Generating a certificate signing request (CSR)](/acquia-cloud-platform/manage-apps/ssl/csr).

Creating a command-line CSR
---------------------------

To generate a CSR:

1.  In the directory `/mnt/gfs/[application].prod/ssl` (where `[application]` is your [application](/acquia-cloud-platform/manage-apps) in Cloud Platform), copy the following two files (if they exist) into a new directory for backup:
    *   `[application].conf`
    *   `private.key`
2.  Create a file named `domains.txt` that has a list of all the domains that you want covered by your SSL certificate.
3.  Edit the `[application].conf` file, and then delete everything following the `[alt_names]` section header. If you don’t have an existing `[application].conf` file, download and modify this [`example.sitename.conf`](https://docs.acquia.com/downloadable-resources?cid=3e60e#section-examplesitenameconf) file.
4.  Save the `[application].conf` file.
5.  Run the following command to add the updated list of domains to the `[application].conf` file:
    
        i=1; for domain in $(cat domains.txt) ; do echo "DNS.$i = $domain" ; ((i++)) ;  done >> [application].conf
    
6.  To generate the CSR file, run the following command:
    
        openssl req -nodes -sha256 -newkey rsa:2048 -config [application].conf -keyout private.key -out [application].csr
    
    Even though the information in the `[application].conf` file has pre-populated the default fields with data, you are prompted to enter details for the CSR file. To continue, press the Enter key.
    
7.  Use the following commands to ensure that your `private.key` and CSR files match.
    
        openssl req -noout -modulus -in [application].csr | openssl md5
        openssl rsa -noout -modulus -in private.key | openssl md5
    
    The files should have matching hashes similar to the following example:
    
        (stdin)= 9fb4c34545e3f8140db44b250cd001e0