How to Generate a CSR for a Code Signing Certificate with OpenSSL

This guide explains how a Certificate Signing Request (CSR) is generated for a code signing certificate when you work with OpenSSL, and, just as important, when that approach no longer applies. Since June 1, 2023, the rules for code signing keys changed, so the old software-only OpenSSL workflow is not accepted by Certificate Authorities for a publicly trusted code signing certificate. Read the requirement below first, then use the path that matches how your key is stored.

Important: code signing keys must live on hardware

Under the CA/Browser Forum Code Signing Baseline Requirements, effective June 1, 2023, the private key for every publicly trusted code signing certificate, both standard (OV) and Extended Validation (EV), must be generated and stored in a hardware crypto module that meets FIPS 140-2 Level 2, Common Criteria EAL4+, or an equivalent standard. The key must be non-exportable. EV code signing always required hardware; this rule extended the same protection to standard certificates.

The practical consequence: a private key and CSR generated purely in software with plain OpenSSL on a laptop or server is no longer accepted for issuing a publicly trusted code signing certificate. Certificate Authorities have stopped supporting browser-based key generation and software CSRs for these products. Your key now lives in one of these places:

• A hardware token shipped to you (for example a YubiKey or a SafeNet/Thales eToken). With the token + shipment delivery method, the Certificate Authority generates the key on the device and handles the CSR, so you do not create one with OpenSSL.
• A Hardware Security Module (HSM) you control, on premises or cloud-based. Here you generate the key inside the HSM and produce a CSR plus a key attestation that proves the key was created in hardware.
• A cloud signing service that keeps the key in a compliant HSM on your behalf.

Pick your route by how you plan to receive and store the certificate. For an overview, see the code signing delivery methods guide. For hardware-backed CSR and attestation steps, follow the guide that matches your device:

• YubiKey 5 FIPS: CSR generation and attestation
• Luna Network Attached HSM v7.x: CSR and attestation guide

If you use a different HSM, generate the CSR with that vendor’s tooling so the key stays in hardware. The OpenSSL req command shown later still has a role in those workflows when OpenSSL drives the HSM through a provider or engine, but it must reference a key that already lives in the module, never a plain software key file for a publicly trusted certificate.

When the software OpenSSL method still applies

The software workflow below produces a key file on disk. That is acceptable only for cases that are not a publicly trusted code signing certificate, such as:

• Internal or test signing with a private/enterprise CA, where your own policy, not the public CA/Browser Forum rules, governs key storage.
• Learning the OpenSSL command structure before you move to a token or HSM.
• Preparing the subject details and command syntax you will reuse when generating the real CSR against your hardware key.

Do not submit a software-generated key and CSR to a public Certificate Authority for an OV or EV code signing certificate. It will be rejected. With that boundary clear, here is the OpenSSL process and the commands involved.

1. Download and install OpenSSL

If OpenSSL is not already on your computer, download a current build (OpenSSL 3.x or later) for your operating system and install it. macOS and most Linux distributions ship OpenSSL already; on Windows you typically install a third-party build. Confirm the install and version with:

openssl version

2. Open a terminal and load OpenSSL

On Windows, press the Windows key + R, type cmd, and press Enter. For commands that write files into protected folders, run the Command Prompt as administrator: right-click the Command Prompt icon and choose Run as administrator. You can also type cmd into the taskbar search and open the Command Prompt from there. On macOS or Linux, open your terminal application.

If the OpenSSL binary is not on your system path on Windows, change into its install folder first, using whichever path matches your build:

cd \OpenSSL-Win32\bin

cd "\Program Files\OpenSSL-Win64\bin"

3. Generate the private key and the CSR

First generate the private key. Code signing certificates require a strong key: use RSA 3072-bit (or larger), which is the common minimum for code signing, or an ECDSA key on the P-256 curve. To create an RSA 3072-bit key:

openssl genrsa -out code_signing_key.key 3072

Then generate the CSR from that key. OpenSSL uses SHA-256 for the request signature by default in current versions:

openssl req -new -key code_signing_key.key -out code_signing_csr.txt

4. Complete the CSR fields

OpenSSL prompts for the details that identify the certificate holder. Enter accurate, current information that matches your legal organization records, because the CA validates it. Replace the examples with your own details:

• Country (C): the two-letter country code where your company is registered or where you reside, for example US.
• State or Province (ST): the full state or province name, for example California.
• Locality (L): the city where your company is registered, for example San Jose.
• Organization Name (O): the official, legal name of your organization, or your full legal name if the certificate is for an individual, for example GPI Holding LLC.
• Organizational Unit (OU): the department requesting the certificate, for example IT. This field is optional.
• Common Name (CN): the legal name of your organization, or your full name for an individual certificate. For code signing, the Common Name is the identity that appears as the publisher.
• Email Address: a valid contact email address.

You can leave the optional challenge password and optional company name fields blank: just press Enter at those prompts.

You can also combine steps 3 and 4 into a single command. The -subj flag supplies the subject inline so OpenSSL does not prompt, and -nodes leaves the key unencrypted on disk (OpenSSL 3.x renamed this flag to -noenc, but -nodes still works). Note that the value uses straight quotation marks, not curly ones, and the whole string is enclosed in one pair of quotes:

openssl req -new -newkey rsa:3072 -nodes -keyout code_signing_key.key -out code_signing_csr.txt -subj "/C=US/ST=California/L=San Jose/O=GPI Holding LLC/OU=IT/CN=GPI Holding LLC"

5. Verify the CSR

Before you submit anything, confirm the CSR is valid and that its details are correct. This command prints the decoded subject and checks the request signature:

openssl req -noout -text -verify -in code_signing_csr.txt

Check that the Subject line lists the country, organization, and common name exactly as you intend, that the public key size is 3072 bits or more (or an ECDSA key), and that the signature algorithm is SHA-256. You should also see a verify OK message, which confirms the CSR was signed by its matching private key.

6. Move the private key and CSR to a safe directory

Move the private key and CSR out of the OpenSSL folder into a directory you control. Keep the private key secret and never share it with anyone outside your organization: anyone who holds it can sign software in your name. On Windows, create a folder and move the files into it:

md c:\codesigningcertificates

move code_signing_key.key c:\codesigningcertificates

move code_signing_csr.txt c:\codesigningcertificates

7. Submit the CSR to your CA

Open the CSR file in any plain-text editor, such as Notepad, and copy its entire contents, including the —–BEGIN CERTIFICATE REQUEST—– and —–END CERTIFICATE REQUEST—– lines, into the enrollment form during your certificate order. A CSR block looks like this:

-----BEGIN CERTIFICATE REQUEST-----
MIICvDCCAaQCAQAw...
...base64 encoded request...
-----END CERTIFICATE REQUEST-----

Remember the rule from the top of this guide: for a publicly trusted code signing certificate, the CSR you submit must correspond to a key generated and held in compliant hardware. If you generated a software key with the steps above, use it only for internal or test signing. For a public CA order, generate the CSR from your token or HSM using the YubiKey or Luna HSM guide, or let the CA generate the key when you choose the token + shipment delivery method.

For general OpenSSL syntax beyond CSR creation, the OpenSSL commands reference is a useful companion. You can also explore more OpenSSL tutorials and code signing tutorials, or read other ways to generate a CSR.