Re: Generating CSR AND public key for Letsencrypt

[Tim Bronski <tim.bronski@xxxxxxxxx>]

Yes you can do it but it's a pain. IMO for a "production" web site it's 
not worth the effort for the relatively low $ it costs to get from from 
someone like GoDaddy. That said, this is how I do it for a test server. 
I'll presume you're familiar with openssl. I use the windows binaries 
that sometimes take slightly different command parms.

Use openssl to generate a public key pair with the genrsa option and 
store the output in a file (mykeypair).

Create your CSR in DCM. If the CSR is titled "----BEGIN NEW CERTIFICATE 
REQUEST-----" change it to "-----BEGIN CERTIFICATE REQUEST-----". 
Similarly for the END marker.

On the https://gethttpsforfree.com/ web page fill in the email address, 
your public key (mykeypair.pub) and cut and paste the modified CSR.

Now go through the signing requests. I cut and paste the quoted text 
from the strings into a file (tosign.txt) and then use this:

openssl dgst -sha256 -hex -sign mykeypair.key tosign.txt |clip

I can then paste from the clipboard. Do this x3 and validate.

Once you get the signed cert copy to the IBMi and install. Make sure you 
have the intermediate cert loaded.

Tim

On 10/21/2016 4:40 AM, Pete Helgren wrote:
> The first part, generating a CSR is easy.  I can go to DCM and 
> generate a CSR but the website that allows you to manually create a 
> Letsencrypt SSL cert asks for a Public Key AND the CSR. So, where 
> would I find/generate/export a public for the CSR?  To get an idea of 
> what I am dealing with, look here: https://gethttpsforfree.com/
>
> The recommendation there is generate the key with openssl, which I 
> have done in the past when I have generated a non-DCM CSR.  But, when 
> DCM is creating the CSR, where do I find the public private keys?  I 
> expect that they are stored somewhere, just like when I create 
> certs/csr's using openssl.  Just need to know the location.
>
> Or, maybe this just isn't possible with DCM...?