---
title: "Create an SSL certificate based on a Certificate Signing Request"
canonical: "https://docs.cuesystem.com/space/HTBCA/482279617/Create%20an%20SSL%20certificate%20based%20on%20a%20Certificate%20Signing%20Request"
format: markdown
---
Create a text configuration file with the EXT extension in the name, e.g. **api.contoso.com.ext**. Save this configuration text file to your working folder.

The file will contain the following text. In **DNS.1**, enter the **URL of the website you are signing** with the SSL certificate.

> 📝 authorityKeyIdentifier=keyid,issuer  
> 📝 basicConstraints=CA:FALSE  
> 📝 keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment  
> 📝 subjectAltName = @alt_names
> 📝 
> 📝 [alt_names]  
> 📝 DNS.1 = **api.contoso.com**


Go to the terminal as described here: [https://cue.atlassian.net/wiki/spaces/HTBCA/pages/465928195/Becoming+a+Certificate+Authority#Creating-a-working-folder](https://cue.atlassian.net/wiki/spaces/HTBCA/pages/465928195/Becoming+a+Certificate+Authority#Creating-a-working-folder) 

Run the following command in the terminal:

- ***openssl x509 -req -in ***<span style="color: #ff5630">***api.contoso.com.csr***</span>*** -CA ***<span style="color: #ff5630">***ContosoCARootCertificate.pem***</span>*** -CAkey ***<span style="color: #ff5630">***ContosoCAPrivateKey.key***</span>*** -CAcreateserial -out ***<span style="color: #ff5630">***api.contoso.com.crt***</span>*** -days 1825 -sha256 -extfile ***<span style="color: #ff5630">***api.contoso.com.ext***</span>

where:

- <span style="color: #ff5630">api.contoso.com.csr</span> is a name of the file with Certificate Signing Request
- <span style="color: #ff5630">ContosoCARootCertificate.pem</span> is name of the file with your root certificate
- <span style="color: #ff5630">ContosoCAPrivateKey.key</span> is name of the file with your private key
- <span style="color: #ff5630">**api.contoso.com.crt**</span> is the name of the **SSL certificate that will be created for the website**
- <span style="color: #ff5630">api.contoso.com.ext</span> is the name of the configuration text file created according to the procedure at the beginning of this chapter

You will now be prompted to enter the passphrase you created when you created the private key. For details see [https://cue.atlassian.net/wiki/spaces/HTBCA/pages/465928195/Becoming+a+Certificate+Authority#Creating-Certification-Authority](https://cue.atlassian.net/wiki/spaces/HTBCA/pages/465928195/Becoming+a+Certificate+Authority#Creating-Certification-Authority) .

Now the CRT file with the certificate will be created.

Continue with [https://cue.atlassian.net/wiki/spaces/HTBCA/pages/482115756](https://cue.atlassian.net/wiki/spaces/HTBCA/pages/482115756)