A hash function takes arbitrary sized data and outputs a number in a fixed range. It always outputs the same number for the exact same data. If the data changes by even one bit the hash also changes. Hashes are used to ensure data integrity by creating “fingerprints” of data.

To get an SSL certificate you generate a private key and a Certificate Signing Request (CSR). The CSR contains your public key and some information about your organization/person like location, name and domain name (called common name). You send the CSR to a Certificate Authority (CA) which runs it through a hash function. The CA then encrypts the hash using their private key. This is what is called a digital signature and it can be verified by clients using the CA’s public key.

The hashing function that is used is important because some hashing functions are more prone to collisions compared to others. A collision is when different data result in the same hash. If an attacker can engineer collisions through brute force he can pretend to be your server and that means your SSL certificate is no longer secure.

Browser makers have been pushing webmasters to use the “SHA-2” class of hashing functions over the SHA-1 function because the latter is prone to collision attacks. Here’s how you can generate a private key and a certificate signing request that uses SHA256sum which is a hashing function from SHA-2 family.

Generate a private key and a CSR as follows:

openssl req \
-nodes \
-newkey rsa:4096 \
-sha256 \
-keyout private.key \
-out public.csr

Explanation of the options:

• req – certificate request generation functions
• nodes – don’t encrypt the private key
• newkey – generate a new private key and a CSR. rsa means RSA algorithm and then you specify the size of the key in bits. One of the inventors of the RSA algorithm recommended 2048 bits as the minimum back in 2006. It’s better to be safe and go with a larger key like a 4096 bits one. However, keep in mind that the strength of the crypto depends on the entire chain of keys starting from the root CA key. Unfortunately most CA’s are still using 2048 bit keys.
• sha256 – use sha256 hash function
• keyout – filename that will contain the private key
• out – CSR filename

If you have an existing private key that you want to use you can run this command instead:

openssl req \
-key private.key \
-sha256 \
-new \
-out new.csr

In the above command -key is used to specify the private key file name and -new tells openssl to generate a new CSR.

openssl will ask you for details that you want to be included in the CSR. Things like your location, organization name etc. It will also ask for a “common name” which is where specify your domain name without the www part. Lastly it will ask for a password but don’t input one and just press enter.

After you are done chmod the private key so only root can read it:

chmod 400 private.key

You can upload the CSR to your certificate vendor to get it signed by them. I recommend namecheap if you are looking for an affordable SSL certificate provider.