Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to silently, non interactively, create an SSL certificate. I.e., without get prompted for any data.

The normal way I create the certificate would be:

openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem 

I tried the following:

    openssl genrsa -out server.key 2048
    touch openssl.cnf
    cat >> openssl.cnf <<EOF
[ req ]
prompt = no
distinguished_name = req_distinguished_name

[ req_distinguished_name ]
C = GB
ST = Test State
L = Test Locality
O = Org Name
OU = Org Unit Name
CN = Common Name
emailAddress = test@email.com

openssl req -x509 -config openssl.cnf -nodes -days 7300 -signkey server.key -out /etc/ssl/private/pure-ftpd.pem 

But I still get a prompt for data.

share|improve this question

closed as unclear what you're asking by Gilles, jasonwryan, slm, rahmu, Anthon Dec 9 '13 at 3:01

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

Can you provide an explanation or output of what is happening instead of the desired result? – Patrick Dec 8 '13 at 1:48
I get the help as a output- Anything is wrong with the parameters here: openssl req -x509 -config openssl.cnf -nodes -days 7300 -signkey server.key -out /etc/ssl/private/pure-ftpd.pem – Michael Dec 8 '13 at 2:17
It's best to provide the output of errors when you're having issues. I'm guessing your issue is because of -signkey. This is not a valid openssl req option on my system. The error message will have this as the very first line: unknown option -signkey – Patrick Dec 8 '13 at 3:36
Well that signkey should tell SSL to use the provided key as i know? – Michael Dec 8 '13 at 3:53
Your "normal way to create the certificate" doesn't prompt for any data. Are you not wanting it to output anything? Then use 2> /dev/null. – wingedsubmariner Dec 8 '13 at 5:50
up vote 9 down vote accepted

The thing you're missing is to include the certificate subject in the -subj flag. I prefer this to creating a config file because it's easier to integrate into a workflow and doesn't require cleaning up afterward.

One step key and csr generation:

openssl req -new -newkey rsa:4096 -key www.example.com.key \
    -out www.example.com.csr \
    -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"

One step self signed passwordless certificate generation:

openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
    -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \
    -keyout www.example.com.key  -out www.example.com.cert

Neither of these commands will prompt for any data.

See my answer to this nearly identical question on Super User.

share|improve this answer
O well that's a nice solution. Makes the codes much smaller. Thanks :D – Michael Dec 9 '13 at 0:23
I didn't modify his original config file, as I thought it might be a standin for a more complicated certificate. Some configurations that cannot be represented with a -subj parameter, particularly when you get into v3 extensions and subjectAltName parameters. – robbat2 Dec 9 '13 at 2:02

The command you are looking for is:

openssl req -new -x509 -config openssl.cnf -nodes -days 7300 -key server.key -out /etc/ssl/private/pure-ftpd.pem

Changes from your version:

  • -new is required to generate anything
  • -key used in place of -signkey
share|improve this answer
Thank you very much. – Michael Dec 8 '13 at 22:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.