How to generate a self-signed certificate with Openssl (using git windows bash)

I recently needed to generate a self-signed certificate to test a website locally. I wasn't familiar with the process, and I wanted to share here what I learned.

First, we need a private key. A private key is a long series of characters that must be kept secret. In my context, it will be used to encrypt messages before the client and the server, in a way secure enough to prevent anybody to spy on them.

Once the private key is created, we need to generate another file that will be the "signature" of our certificate. Among other data, this file will contains some information specific to the server's context: country, organization's name, email address of the organization's technical contact, etc.

Once this signature is established, there are two paths:

- Path A: If we want our server to be publicly accessible, every browser in the world must able to trust the certificate. In order for that to happen, we need to send our signature file to one of the official SSL Certificate authorities (Comodo SSL, Symantec SSL, etc.). Those authorities are known by every browsers. Sending the signature file is called a Certificate Signing Request (CSR).

- Path B: For local use, it's also possible to self-signed the certificate. If we were to use this certificate in a public context, the web browsers would display a security alert to the user, saying that the certificate cannot be trusted.

 All those steps can be done with openssl. I have created a bash script to make the process easier and not have to remember each command. You can find it the gist on github here. This script will ask you for the required information, and generate a self-signed certificate (so not to be used for a public server). The comments in the file should be enough to match with the steps described in this article