How To Create A Self-Signed SSL Certificate Using Bash And OpenSSL

Introduction

A self-signed SSL certificate is a certificate that is created and signed by the same system or user instead of a trusted certificate authority. It is commonly used for local testing, development servers, internal tools, labs, and learning HTTPS configuration.

If you are learning Bash scripting, creating a self-signed SSL certificate with OpenSSL is a useful practical task. It helps you understand certificates, private keys, HTTPS testing, and Linux command-line automation. In cybersecurity and Linux administration, SSL certificates are important for encrypted communication between clients and servers.

What Is A Self-Signed SSL Certificate?

An SSL certificate is used to encrypt communication between a browser and a server. A trusted SSL certificate is normally issued by a certificate authority. A self-signed certificate is created by yourself and is not automatically trusted by browsers.

Self-signed certificates are useful for:

Local testingDevelopment environmentsInternal serversCybersecurity labsLearning SSL and HTTPS

They should not be used for public production websites because browsers will show a security warning.

Check If OpenSSL Is Installed

Before creating a certificate, check whether OpenSSL is installed:

openssl version

If OpenSSL is not installed, install it using:

sudo apt updatesudo apt install openssl -y

Create A Private Key And Self-Signed Certificate

Use the following command to create a private key and certificate:

openssl req -x509 -newkey rsa:2048 -keyout private.key -out certificate.crt -days 365 -nodes

This command creates two files:

private.keycertificate.crt

The private.key file is your private key. The certificate.crt file is your self-signed SSL certificate.

Command Explanation

Here is what each option means:

req        # Starts a certificate request operation-x509      # Creates a self-signed certificate-newkey    # Creates a new private keyrsa:2048   # Uses 2048-bit RSA encryption-keyout    # Output file for the private key-out       # Output file for the certificate-days 365  # Certificate validity period-nodes     # Creates key without password encryption

During the process, OpenSSL may ask for details such as country, state, organization name, and common name. For local testing, you can enter your domain, IP address, or localhost.

Bash Script To Create SSL Certificate

Create a Bash script:

nano create-ssl.sh

Add the following code:

#!/bin/bashcert_dir="$HOME/self-signed-cert"mkdir -p "$cert_dir"openssl req -x509 -newkey rsa:2048 \-keyout "$cert_dir/private.key" \-out "$cert_dir/certificate.crt" \-days 365 \-nodesecho "Self-signed SSL certificate created successfully"echo "Private Key: $cert_dir/private.key"echo "Certificate: $cert_dir/certificate.crt"

Give execute permission and run it:

chmod +x create-ssl.sh./create-ssl.sh

Verify The Certificate

To view certificate details, run:

openssl x509 -in certificate.crt -text -noout

If your files are inside the script directory, use:

openssl x509 -in ~/self-signed-cert/certificate.crt -text -noout

Conclusion

Creating a self-signed SSL certificate using Bash and OpenSSL is a useful Linux skill. It helps beginners understand SSL certificates, private keys, HTTPS testing, and secure communication.

Self-signed certificates are best for labs, testing, and internal environments. For public websites, always use a trusted SSL certificate from a recognized certificate authority. Bash scripting makes the certificate creation process faster, repeatable, and easier to manage.