Re: create self-signed cert with config file

On Wed, May 28, 2025 at 04:41:27AM +0000, debian-jy+RX4/[email protected] wrote:

> I'm trying to create a self-signed certificate/private key pair with the
> `openssl` command-line tool, v1.1.1.  There is the usual example:
> 
>   openssl req -x509 -newkey rsa:2048 -keyout foo.key -out foo.crt
> 
> and I can add -addext 'subjectAltName=...' too.  I opened the resulting .crt
> file in Mozilla and verified that it's a CA cert.
> 
> But I'd like to use -config to avoid being prompted for the DN fields.  (I'm
> doing this repetitively.)  When I try 

You don't need "-config" for that, you can just use the "-subj" option,
the example below throws in a couple more extensions, the authority key
id is largely redundant for a trust-anchor, but may be useful in other
cases.

    openssl req -quiet -nodes -x509 -new -out foo.crt \
        -newkey rsa:2048 -keyout foo.key \
        -days 36524 -subj "/CN=My root CA" \
        -addext "basicConstraints = critical,CA:true" \
        -addext "keyUsage = critical, cRLSign, keyCertSign" \
        -addext "subjectKeyIdentifier = hash" \
        -addext "authorityKeyIdentifier = keyid:always"

>   openssl req -x509 -config foo.conf -out foo.crt
> 
> moving as much as I can into the .conf file, the resulting .crt is missing
> fields that I saw with the usual command line.  It doesn't appear to be a CA
> cert at all.  The SAN fields are missing.
> 
> I'm also surprised that not all command-line options have config equivalents:
> -days, for instance.
> 
> Is there a way to do this?

Everything can be done with a config file if you prefer.  See
x509v3_config(3), and various mixtures of command-line options and
inline config snippets (using bash "<(command)" syntax to create on
the fly configs) in:

    https://github.com/openssl/openssl/blob/master/test/certs/mkcert.sh

-- 
    Viktor.

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aDdAC-uOHphyV0RL%40chardros.imrryr.org.