Core Cryptographic File Types

TLS/SSL deployments rely on three distinct artifact categories:

• Private Key: Typically RSA-encoded binary data used for asymmetric decryption and handshake authentication.
• Certificate Signing Request (CSR): A structured payload bundling your public key with identity attributes, prepared for third-party validation.
• X.509 Certificate: The cryptographically signed issuance document, binding an identity to a public key and verifying trust chain validity.

The following procedures demonstrate how to generate, validate, and package these components using standard Linux utilities.

1. Provisioning an RSA Private Key

Initialize a 2048-bit RSA key protected with Triple DES cipher:

openssl genrsa -des3 -out cluster-node.key 2048

This step enforces an interactive passphrase prompt (minimum four characters). To bypass automated execution workflows that require non-interactive startup, extract an unencrypted variant:

openssl rsa -in cluster-node.key -out cluster-node-unlocked.pem

The output contains raw asymmetric material without wrapper encryption.

2. Establishing a Local Certification Authority

Create a self-authorizing root certificate to act as you're internal trust anchor:

openssl req -new -x509 -key cluster-node-unlocked.pem -out internal-root.crt -days 3650

This command generates a decade-long valid self-signed certificate. Subsequent service credentials will reference this authority for cryptographic endorsement.

3. Drafting a Certificate Signing Request

Package your public key alongside organizational metadata into a CSR:

openssl req -new -key cluster-node-unlocked.pem -out web-service.csr

Interactive fields will request country, state, organization, and contact email. The Common Name (CN) parameter must exact match the target hostname or IP address. Mismatched CN values trigger client-side TLS warnings.

4. Endorsing and Issuing the Service Certificate

Process the pending request through your local root authority:

openssl x509 -req -days 3650 -in web-service.csr \
  -CA internal-root.crt -CAkey cluster-node-unlocked.pem \
  -CAcreateserial -out web-service.issued

Parameter breakdown:

• -CA: Targets the issuer's certificate file.
• -CAkey: References the issuer's private signing key.
• -CAcreateserial: Auto-provisions a serial number ledger if absent.

5. Bundling for Service Deployment

Consolidate the decrypted key and endorsed certificate into a single PEM-formatted stream compatible with most reverse proxies and application servers:

cat cluster-node-unlocked.pem web-service.issued > tls-bundle.pem

The resulting asset collection is ready for integration into load balancers, container orchestration platforms, or native web server configurations.