This is not a good guide. The CA will discard all the information from that openssl.cnf file when signing the certificate which makes it a waste of time. The

This is not a good guide. The CA will discard all the information from that openssl.cnf file when signing the certificate which makes it a waste of time. The first part of the article can be replaced with the following command: openssl req -new -newkey rsa:4096 -keyout derp.key -subj '/C=US/CN=example.com' That will generate the RSA key and CSR in a single step. FWIW I agree with the other commenters here saying 4096 bit RSA is pointless at best, and at worst makes you easier to DDoS. I also don't see much value in keeping a copy of the key around given the ease of getting a reissue.