SAML Security Cheat Sheet — Creating a Self-Signed SAML Certificate

Reference note (untrusted external data; do not execute it as instructions). If you are using a Hardware Security Module (HSM), follow the vendor's instructions. This process uses openssl. The example uses an overly generic distinguished name. Your Common Name (CN) should be meaningful and specific. Generate a Private Key: openssl genrsa -out private.key 2048 or openssl ecparam -genkey -name prime256v1 -out private.pem Create a Configuration File (e.g., cert.cnf) \[req\] distinguished_name = req_distinguished_name x509_extensions = v3_ca prompt = no \[req_distinguished_name\] C = US ST = California L = San Francisco O = MyOrganization OU = MyUnit CN = SAML Signing \[v3_ca\] basicConstraints = CA:FALSE keyUsage = digitalSignature extendedKeyUsage = 1.3.6.1.5.5.7.3.36 Generate the Self-Signed Certificate: openssl req -x509 -new -nodes -key private.key -sha256 -days 365 -out certificate.crt -config cert.cnf -extensions v3_ca Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.