In order to request a SSL certificate from any dealer, you usually need a CSR certificate. As both the CSR as well as key are created in this step, make sure you save this certificate on a trusted, secure machine only. Usually this is your production environment.
Run this on the server (not on your machine) as root.\
Replace your-domain.tld with the domain you request the certificate for and YYYY with the current year so you will not have any conflicts when requesting a certificate next year.
openssl req -new -sha256 -out www.your-domain.tld-YYYY.csr -keyout www.your-domain.de-YYYY.key -newkey rsa:2048 -nodes
You need to enter some details regarding the owner of the domain (usually the client):
Country Name (2 letter code) [AU]:DE
State or Province Name (full name) [Some-State]:BY
Locality Name (eg, city) []:Augsburg
Organization Name (eg, company) [Internet Widgits Pty Ltd]:makandra GmbH
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:www.your-domain.tld
Email Address []:ssladmin@your-domain.tld
The next to last line is important as this will define for which domain the certificate will be valid for. If you mistype the certificate will be invalid!
After completing the wizard, you have two files (www.your-domain.tld-YYYY.csr and www.your-domain.tld-YYYY.key).
You can now safely transfer the .csr over insecure media to your SSL dealer. The key should never be transfered away from the server.
