Generating a Certificate Signing Request on your FLOW server

Generating a Certificate Signing Request (CSR) is a standard step when requesting an SSL/TLS certificate for a domain which will allow you to replace the self signed certificate which backs FLOW services such as EditShare One. This guide details how to generate a CSR using OpenSSL on EditShare and explains why preserving your key password is essential if you protect your private key.

Step 1: Generate the Private Key and CSR

To issue a CSR, OpenSSL creates two primary files:

Private Key File (.key): Kept securely on your server; never shared.
CSR File (.csr): Sent to a Certificate Authority (CA) to request the certificate.

Command Execution

Run the following command in your FLOW terminal to generate both files in a single step using 2048-bit RSA encryption:

Without a passphrase:

openssl req -new -newkey rsa:2048 -nodes -keyout flow.example.com.key -out flow.example.com.csr

Note: If you wish to protect your private key with a passphrase, omit the -nodes flag:

openssl req -new -newkey rsa:2048 -keyout flow.example.com.key -out flow.example.com.csr

Step 2: Fill in the Certificate Information

When prompted, enter the requested information. Ensure the Common Name (CN) matches your domain name exactly:

Field Prompt	Example Input	Description
Country Name (2 letter code)	`US`	Two-letter ISO country code
State or Province Name	`California`	Full state or province name
Locality Name	`San Francisco`	City or locality
Organization Name	`Example Corp`	Legal company name
Organizational Unit Name	`IT Department`	Division or department
Common Name	`flow.example.com`	Must match the domain name
Email Address	`admin@example.com`	Contact email address

Optional Fields: You may be asked for a Challenge Password or Optional Company Name. In most standard CA requests, you can press Enter to leave these blank.

Step 3: Important Note on Private Key Passwords

If you chose to protect your private key with a password (by omitting -nodes in Step 1):

Why the Password Matters

Encrypted Key Access: The private key (flow.example.com.key) is encrypted on disk. Any service or API gateway attempting to load this key will require the passphrase to decrypt it in memory.
Gateway Configuration: You will need to retain this password and use it in your FLOW/EditShare gateway configuration.

Note: Store the private key passphrase securely in a team password manager or secret management vault if you have one. If the passphrase is lost, the private key cannot be decrypted, and the certificate will need to be reissued.

Step 4: Verify the CSR Contents

Before submitting the CSR to your Certificate Authority, you can verify its contents using OpenSSL:

openssl req -text -noout -verify -in flow.example.com.csr

The Subject line contains CN = flow.example.com.
All organization details are spelled correctly.

Step 5: Submit your Certificate Signing Request to your Signing Authority

Either by copying the full text of flow.example.com.csr (including -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST-----)

By uploading the file you generated flow.example.com.csr

Articles in this section