Overview
After you buy an SSL certificate from another company, your Certificate Authority (CA) needs a Certificate Signing Request (CSR) to issue it. You can create a CSR in the DreamHost panel or manually via SSH.
Background
A Certificate Signing Request (CSR) is a file you use to request an SSL certificate from a Certificate Authority (CA). The CSR contains information such as your name, address, domain name, and email, along with your public key. The Certificate Authority validates this information before creating your SSL certificate.
When you create a CSR, a private key is created with it. You need both to import your certificate.
These instructions are only necessary if you purchase your SSL certificate at another company. If you have no reason to do this, you can add a free SSL certificate in your DreamHost panel instead. See Adding a free Let's Encrypt certificate.
How do I create a CSR in the panel?
Navigate to the Manage Websites page.
Click the Manage button to open Website settings, which allows you to modify various configurations for your site.
If in Grid view, click the Manage button at the bottom of the website box.
If in List view, click the Manage button at the far right of your domain name.
Click the Security tab.
Expand Import a Certificate. If your site already has a certificate, click Manage and then Change first.
Click Generate, complete the form, and click Generate again.
Download the CSR and private key, then click Done.
Give the CSR to your CA. When you receive your certificate, see Install a third-party SSL certificate to import it.
How do I create a CSR manually?
You are able to manually create a CSR by logging in to your server via SSH and running the commands below.
To proceed with these steps, make sure you have created a shell user and are able to log into your server via SSH.
Log in to your domain via SSH.
The CSR must be created on the server where the SSL certificate will be used.
Navigate into your user's home directory:
[server]$ cd ~
Run the following command to generate a new RSA private key.
[server]$ openssl genrsa -out private.key 2048
This creates a file named private.key in the user's home directory. You'll use this to create the CSR in the next step.
Run the following command to create the CSR. Enter each field with your domain's information.
[server]$ openssl req -new -sha256 -key private.key -out file.csr Country Name (2 letter code) [AU]: State or Province Name (full name) [Some-State]: Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]: Organizational Unit Name (eg, section) []: Common Name (eg, YOUR name) []: Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: . An optional company name []: .
Common Name is where you put your domain name, e.g., example.com or www.example.com.
For the challenge password and optional company name, type in a period and press the Enter key to proceed.
Save the private.key file. You need it, along with the CSR, to import your certificate.
How do I view the CSR file?
Your CSR is created in a file named file.csr. You can view its contents by running the following command:
[server]$ cat file.csr
You can either cut and paste this code to a file on your local computer or log into your server via FTP and download the file.
How do I use the CSR file?
The final step is to provide the CSR file to the certificate authority company where you are purchasing an SSL certificate. They will then use the CSR file to order/renew a signed SSL certificate for you to use at DreamHost.
