SSL new cert generation

Below are steps for generating certificates in your Organization.

Private key generations using OpenSSL:

#openssl genrsa -out hostname.domain.com.key 2048

CSR generation using openssl:

#openssl req -new -key hostname.domain.com.key -out hostname.domain.com.csr -nodes -subj "/C=US/ST=Region/L=Location/O=Organization/OU=UNIT/CN=hostname.domain.com/emailAddress=support.help@domain.com" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:hostname,DNS:hostname.domain.com,DNS:api.hostname.domain.com,DNS:storage.hostname.domain.com,DNS:tasks.hostname.domain.com"))

Acquire security certification from CA:

Security certificate needs to be provided by the cert admins. Work with AD Team Admins or one who supports certs in your Organization

NOTE: for most it ends here if you need pem or pfx file follow respective steps to generate keys 

#####################################################################################

To generate .pem key use below 

Create a .pem file using .crt and .pem keys

#cat hostname.domain.com.key hostname.domain.com.csr > hostname.domain.com.pem

To generate .PFX key use below 

Convert Security certificate file to PFX

Once the certificate file is provided by the cert admins, it needs to be converted to pfx (pkcs12) format to be successfully imported into IIS.

Use the following command from the location where the cert and key files are placed. presence of key files is mandatory for successful conversion.

pkcs12 conversion

#openssl pkcs12 -inkey hostname.domain.com.key -in hostname.domain.com.crt -export -out hostname.domain.com.pfx -name "hostname.domain.com_cert" -nodes -passout pass: