Signing the certificate signing request

For each node, sign the certificate signing request. If you created your own root CA, follow the instructions below. Alternatively, send the certificate signing request to a well-known CA for signing.


  1. Sign each node certificate:

    openssl x509 -req -CA 'path/to/rootca.crt' \
    -CAkey 'path/to/rootca.key' \
    -in signing_request.csr \
    -out signing_request.crt_signed \
    -days 3650 \
    -CAcreateserial \
    -passin pass:rootca_password \
    -extfile san_config_file.conf

    Certificate signing request (CSR) that is passed to the Certificate Authority (CA) to sign the certificate. The CSR typically includes the public key plus associated metadata such as the Common Name (CN), Organization (O), Organization Unit (OU), and Country (C).

    signing_request.crt_signed The signed certificate file to create, using the certificate signing request (CSR) (signing_request.csr) as the input file.


    If using the domain name as the <node_name> and the node IP address as a Subject Alternative Name (SAN), create a temporary configuration file and pass it in using the -extfile option. In the configuration file, use the subjectAltName parameter to specify the DNS and IP. For example:


    You can specify multiple SANs in the same configuration file:


    Use the <rootca_password> entered when Creating the root CA signing certificate.

    A signed certificate file signing_request.crt_signed is created.

  2. Verify that the root certificate file was properly signed:

    openssl verify -CAfile '<path/to/rootca.crt>' <signing_request.crt_signed>
    <signing_request>.crt_signed: OK
  3. Delete the temporary configuration <file san_config_file>.conf to protect the SAN for a node.

    rm -f <san_config_file.conf>

Was this helpful?

Give Feedback

How can we improve the documentation?

© 2024 DataStax | Privacy policy | Terms of use

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: +1 (650) 389-6000,