Re: Generating CSR AND public key for Letsencrypt

Yes you can do it but it's a pain. IMO for a "production" web site it's not worth the effort for the relatively low $ it costs to get from from someone like GoDaddy. That said, this is how I do it for a test server. I'll presume you're familiar with openssl. I use the windows binaries that sometimes take slightly different command parms.

Use openssl to generate a public key pair with the genrsa option and store the output in a file (mykeypair).

Create your CSR in DCM. If the CSR is titled "----BEGIN NEW CERTIFICATE REQUEST-----" change it to "-----BEGIN CERTIFICATE REQUEST-----". Similarly for the END marker.

On the https://gethttpsforfree.com/ web page fill in the email address, your public key (mykeypair.pub) and cut and paste the modified CSR.

Now go through the signing requests. I cut and paste the quoted text from the strings into a file (tosign.txt) and then use this:

openssl dgst -sha256 -hex -sign mykeypair.key tosign.txt |clip

I can then paste from the clipboard. Do this x3 and validate.

Once you get the signed cert copy to the IBMi and install. Make sure you have the intermediate cert loaded.

Tim

On 10/21/2016 4:40 AM, Pete Helgren wrote:

The first part, generating a CSR is easy. I can go to DCM and generate a CSR but the website that allows you to manually create a Letsencrypt SSL cert asks for a Public Key AND the CSR. So, where would I find/generate/export a public for the CSR? To get an idea of what I am dealing with, look here: https://gethttpsforfree.com/

The recommendation there is generate the key with openssl, which I have done in the past when I have generated a non-DCM CSR. But, when DCM is creating the CSR, where do I find the public private keys? I expect that they are stored somewhere, just like when I create certs/csr's using openssl. Just need to know the location.

Or, maybe this just isn't possible with DCM...?