To generate RSA private key using 2048 long modulus use command:
# openssl genrsa -out www.shkodenko.com.key 2048
If you want to password protect your key add -des3 parameter. You can also increase key modulus to 4096 to make it more secure.
To generate CSR using secure SHA256 algorithm the following command can be used:
# openssl req -sha256 -new -key www.shkodenko.com.key -out www.shkodenko.com-sha256.csr
There is also genkey utility. By default it will generate CSR with SHA1 but you can change it in configuration file /etc/pki/tls/openssl.cnf:
# diff -Nau /etc/pki/tls/openssl.cnf-2015-06-26.bak /etc/pki/tls/openssl.cnf
— /etc/pki/tls/openssl.cnf-2015-06-26.bak 2015-01-13 13:34:32.000000000 +0000
+++ /etc/pki/tls/openssl.cnf 2015-06-26 16:13:28.000000000 +0000
@@ -104,7 +104,7 @@
####################################################################
[ req ]
default_bits = 2048
-default_md = sha1
+default_md = sha256
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
