How to Create a Self-Signed Certificate with openssl

Resolving The Problem

Openssl is an open source utility that comes shipped with 5733SC1 Option 1 OpenSSH, OpenSSL, zlib and can be used in the PASE environment to be a key management store.

To generate a self-signed certificate on the IBM i using OpenSSL, you should follow the steps below:

Step 1: Enter the PASE environment by issuing the command CALL QP2TERM

Step 2: Generate a private key with the command openssl genrsa -des3 -out server.key 1024


Step 3: Generate a Certificate Signing Request with the command openssl req -new -key server.key -out server.csr






Step 4: Remove Passphrase from Key with the command cp server.key server.key.org followed by openssl rsa -in server.key.org -out server.key


Step 5: Generate the Self-Signed Certificate with the command openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

The last optional command is to convert the certificate to a PKCS12 format with the command openssl pkcs12 -export -out exported.pfx -inkey server.key -in server.crt