Manage your own SSL Certificates

This step requires that you generate the CSR to send to the Certificate Authority (CA) when applying for a signed certificate.

If you already have a Certificate (CRT), certificate key (KEY), certificate signing request (CSR) and the Certificate Bundle (Root Intermediary Certificate) you can skip this step and go directly to step 4 - Step 4 - Upload SSL Certificates and RSA Key.

1. Login to SpamExperts as a Super-Admin Level user
2. Navigate to Branding > Certificates
3. In the Generate Certificate Signing Request (CSR) and RSA Key section, click Generate CSR & RSA Key

   

4. Enter the details:
   1. Country
   2. Organisation (Required)
   3. E-mail (Required)
   4. State
   5. Locality
   6. Organisation unit
   7. Server name
5. Click Generate. You will see the window now displays two tabs:
   1. CSR tab containing the Certificate Request:

      

   2. RSA key tab containing the RSA key

      

6. Copy the contents of both tabs and paste them into a text document, ensuring this is saved somewhere easily accessible and safe

   You will need the CSR when applying for a signed certificate to the Certificate Authority (CA), and the RSA key will be used later on when uploading the certificate to SpamExperts.
   See Step 4 - Upload SSL Certificates and RSA Key.

RSA Key

Ensure you have OpenSSL installed on your machine before beginning.

1. Open a terminal
2. Create a key and sign the certificate with it using the following command:

openssl genrsa -out demo-domain.invalid.key 2048

Replace demo-domain.invalid with the hostname the certificate is intended for

The output should be similar to:

Generating RSA private key, 2048 bit long modulus ......+++ .........................+++ e is 65537 (0x10001)

The process may take a little while before you can go on to the next step.

Keep the RSA key safe - without it you cannot generate the certificate signing request (CSR). You also need it later when uploading the certificate.

CSR

1. After generating the RSA key (also known as a private key) and have taken a note of this, create the CSR using the following command:

openssl req -new -key demo-domain.invalid.key -out demo-domain.invalid.csr

Replace demo-domain.invalid with the hostname the certificate is intended for

2. Enter the required information but do not set a challenge password

You are about to be asked to enter information that will be incorporated 
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank.
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----   
Country Name (2 letter code) [AU]: NL
State or Province Name (full name) [Some-State]: State
Locality Name (eg, city) []: Cityname
Organization Name (eg, company) [Internet Widgits Pty Ltd]: Your Company Name
Organizational Unit Name (eg, section) []: Department
Common Name (eg, YOUR name/FQDN) []:demo-domain.invalid
Email Address []:example@demo-domain.invalid

Please enter the following 'extra' attributes 
to be sent with your certificate request
A challenge password []:
An optional company name []:

3. Press Enter once complete



The Common Name is important and must match your server CNAME/Control Panel Hostname settings.

If, for example, your Control Panel is hosted at server1.demo-domain.invalid, you should enter this as the Common Name. DO NOT enter HTTP:// or HTTPS://

Take a note of the CSR generated here and save it to a text document