Generating a CSR using OpenSSL

This article applies to:

• Trustwave MailMarshal (SEG)
• MailMarshal SPE

Question:

• How do I generate a CSR (Certificate Signing Request) for TLS using OpenSSL?
• Certificate authority does not accept MailMarshal CSR with MD5 hash

Information:

The MailMarshal SMTP TLS wizard can be used to generate Certificate Signing Requests (CSRs) for submission to a Certificate Authority.

Some Certificate Authorities do not accept these CSRs due to technical requirements for the algorithms used in the request.

If you require a CA signed certificate using specific algorithms, you can create the CSR using the free software OpenSSL.

• Download OpenSSL Light for Windows. You may also require the Visual C++ executables as linked from the OpenSSL download page.
• Install OpenSSL on any computer. 

To generate the CSR:

1. Open a command prompt and change the working directory to the OpenSSL location (default: C:\OpenSSL-Win32\bin)
2. Generate a private key, using the following command:
   
   openssl genrsa -des3 -out cakey.key 2048
   • You will be required to enter a password.
   • You can enter any name and location for the key file.
   • You can customize the parameters. See the Help installed with OpenSSL.
3. The result is a file cakey.key which is required (along with the password) to create the CSR and later when importing the signed certificate into MailMarshal. 
4. Generate the CSR using the following command:
   
   openssl req -new -key cakey.key -out cakey.csr
   
   • You are prompted to enter the private key password created above.
   • You are prompted to enter the Distinguished Name information. See sample information below:
     
     

5. Use the CSR file to request a signed certificate from your Certificate Authority.  

To verify the contents of the CSR:

• Use the following command:
  
  openssl req -in cakey.csr -noout -text
  
  
• The output will be similar to the following:

Certificate Request:

Data:

Version: 0 (0x0)

Subject: C=UK, ST=HANTS, L=Basingstoke, O=M86Security#, OU=Support, CN=mail1.marshal.test/emailAddress=postmaster@marshal.test

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

Public-Key: (2048 bit)

Modulus:

00:b9:18:57:65:f3:e3:fa:72:09:a5:eb:a0:fe:33:

74:d2:2c:fe:10:88:93:e9:33:db:ef:23:f5:47:7d:

72:a6:78:ef:43:e6:4c:4a:9f:fc:46:2c:77:da:b1:

77:b4:c7:31:12:63:9f:29:84:6c:1b:30:28:0a:44:

2f:92:26:da:4a:be:75:08:da:6c:b0:00:a6:dc:fd:

88:4b:61:d7:f2:91:00:6a:5e:08:69:9b:cd:36:89:

6f:a6:4c:56:f3:68:fb:41:31:a4:b6:38:f4:fc:69:

3d:5d:2d:be:be:5e:c7:41:03:90:d3:ed:04:38:a9:

fb:0d:8d:fc:f6:98:f0:d1:0e:ff:5d:57:68:50:8a:

09:7f:50:0b:ca:de:87:5c:80:98:83:04:b8:a5:99:

68:4d:2f:be:9c:d5:1d:7d:4c:15:44:40:fd:a1:9b:

b8:4c:07:c8:db:c0:8b:12:61:68:4e:fc:7e:17:83:

b2:90:df:37:ba:08:97:0b:e2:6d:31:1d:20:ae:65:

05:c3:3c:5b:29:a5:26:7a:74:fb:ba:6e:8d:07:89:

c2:87:ec:f5:a4:b3:a2:f9:d4:97:b1:d4:23:b7:7f:

c7:78:27:93:dc:cc:72:92:cf:87:14:19:04:8c:5f:

e7:90:b4:df:5c:56:08:6e:1a:cd:6d:63:2c:40:1b:

f0:dd

Exponent: 65537 (0x10001)

Attributes:

unstructuredName :unable to print attribute

Signature Algorithm: sha1WithRSAEncryption

57:1f:09:eb:8f:a9:5c:f1:12:3c:88:cb:f6:79:59:25:bf:11:

88:02:76:9f:1c:e7:ad:5a:0b:99:1d:ea:8a:9b:f4:6a:c0:06:

8d:0b:bf:53:22:79:76:9d:be:b8:7b:18:72:a3:d3:14:10:3f:

05:6b:1c:22:4d:59:cd:04:c1:1c:de:b4:cd:ea:df:49:17:79:

22:a4:10:10:70:ea:4a:9a:f0:f0:d5:6f:7b:ea:20:51:44:d4:

c7:b2:ac:6f:35:37:fb:21:bc:7e:cb:e4:21:f2:08:fa:f2:29:

46:66:56:4d:86:59:64:5a:f6:64:fa:70:26:c7:8f:cb:96:ab:

d4:4a:c3:82:b3:6d:b5:0a:87:71:3e:6c:d1:a1:ef:db:5d:c3:

a8:fc:51:54:2d:cd:1c:5f:0a:42:db:7d:9c:17:30:ef:87:b3:

88:87:50:34:da:a8:b5:62:a2:96:31:01:c3:d7:af:37:df:f5:

b0:ab:22:0d:38:0f:b0:e2:ad:00:4e:5b:37:03:3f:0b:93:e8:

67:3d:ba:68:73:57:01:90:14:9e:c7:1e:c9:50:26:97:6f:aa:

10:c0:f1:74:4a:c8:1a:f1:10:52:38:3e:66:4f:6a:95:16:58:

ec:70:26:dd:59:74:ee:da:b0:22:a1:27:4b:b7:58:69:3f:96:

02:4c:90:b1

To import the certificate you need the key and certificate files, and the password for the key.

1. Open MailMarshal Configurator or MailMarshal (SEG) 10 Management Console.
2. Expand Server and Array Configuration > Servers (MailMarshal (SEG) 10: Mail Servers), and select the processing node where you want to install the certificate.
3. Select Inbound Security (TLS).
4. Click TLS Certificate Wizard.
5. Select Import a signed certificate and click Next.
6. Browse to the certificate and password files, and enter the password for the private key.
7. Click Next to complete the import of the certificate, and then finish the wizard.
8. On the Inbound Security window, select Enable TLS...  You can also choose to require TLS for all inbound connections.  For more information please see Help for this window.

Notes:

• You can also generate the CSR using the Certreq.exe tool that is included with Windows Server. Basic documentation for this tool is available in the following Microsoft Technet articles:
  • Certreq 
  • Certreq.exe Syntax