XK0-006 Security Practice Question
An administrator needs to generate a self-signed certificate and private key for a web server. Which openssl command accomplishes this?
⚠ Common exam trap
Candidates often confuse the `openssl req -new -x509` command with the CSR-only `openssl req -new` command, or think that a CSR is required for self-signed certificates, when in fact the `-x509` flag directly outputs a self-signed certificate without needing a separate CSR step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
openssl genrsa -out key.pem 2048 && openssl req -new -x509 -key key.pem -out cert.pem -days 365
It first generates a 2048-bit RSA private key using `openssl genrsa`, then uses `openssl req -new -x509` to create a self-signed X.509 certificate directly from that key, bypassing the need for a Certificate Signing Request (CSR). The `-x509` flag tells OpenSSL to output a self-signed certificate instead of a CSR, and `-days 365` sets the validity period. This two-step process produces both the private key (`key.pem`) and the self-signed certificate (`cert.pem`) required for a web server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
openssl genrsa -out key.pem 2048 && openssl req -new -x509 -key key.pem -out cert.pem -days 365
Why this is correct
Chaining genrsa with req -new -x509 produces both the private key and a self-signed certificate in one pass. The -x509 flag makes req emit a certificate rather than a signing request, satisfying the self-signed requirement without a separate CA step.
- ✗
openssl req -new -key key.pem -out csr.pem
Why it's wrong here
This generates only a certificate signing request; it creates no private key and no certificate, so the web server still lacks both artefacts. It is tempting because `req -new` is the usual first stage of a CSR workflow, and it would be correct when submitting to a public CA rather than self-signing.
- ✗
openssl ca -in csr.pem -out cert.pem
Why it's wrong here
`openssl ca` acts as a CA signing requests against an existing CA configuration and database, and it neither generates a key nor self-signs. It is tempting because it does emit a certificate from a CSR, which fits an internal PKI where a configured CA directory already exists.
- ✗
openssl x509 -req -in csr.pem -signkey key.pem -out cert.pem
Why it's wrong here
This command signs an existing CSR with a supplied key, so it requires csr.pem to already exist and never creates the private key the task demands. It is tempting because `-signkey` genuinely produces a self-signed certificate, which is the right operation once a CSR and key are present.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
Learn chapter
Process Management and System Monitoring
Key term
Process
In IT service management, a process is a structured set of activities designed to accomplish a specific objective, such as managing incidents or changes, by transforming inputs into defined outputs.
Key term
Output
In IT service management, output is the result or deliverable produced by a process, system, or component, such as data, reports, or services delivered to a customer.
About these practice questions
This XK0-006 question is part of Courseiva's 781-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.