Create a new TLS certificate signed by an intermediate certificate using openssl

Question

I have a trusted intermediate key and certificate (PEM files) that I own and I would like to create a certificate for my load balancer that is signed by it.

How is this done using openssl?

Answer 1

Assume you already have your root key/cert pair files as follows:

.
root-cert.pem
root-key.pem

Here are the steps to generate a public facing certificate that you can use for your server. First, create a new private key:

openssl genrsa -out my.key.pem 2048

Next, create a certificate signing request CSR with the new key:

openssl req -new -sha256 -key ./my.key.pem -out ./my.csr

Third, create your signed public certificate (valid for 1 year)!

openssl x509 -req -in my.csr -CA root-cert.pem -CAkey root-key.pem -CAcreateserial -out my.crt.pem -days 365 -sha256