25

I want to silently, non interactively, create an SSL certificate. I.e., without get prompted for any data.

The normal way I create the certificate would be:

openssl req -x509 -nodes -days 7300 -newkey rsa:2048 \
    -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem 

I tried the following:

openssl genrsa -out server.key 2048
touch openssl.cnf

cat >> openssl.cnf <<EOF
[ req ]
prompt = no
distinguished_name = req_distinguished_name

[ req_distinguished_name ]
C = GB
ST = Test State
L = Test Locality
O = Org Name
OU = Org Unit Name
CN = Common Name
emailAddress = test@email.com
EOF

openssl req -x509 -config openssl.cnf -nodes -days 7300 \
    -signkey server.key -out /etc/ssl/private/pure-ftpd.pem 

But I still get a prompt for data.

closed as unclear what you're asking by Gilles, jasonwryan, slm, rahmu, Anthon Dec 9 '13 at 3:01

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Can you provide an explanation or output of what is happening instead of the desired result? – Patrick Dec 8 '13 at 1:48
  • I get the help as a output- Anything is wrong with the parameters here: openssl req -x509 -config openssl.cnf -nodes -days 7300 -signkey server.key -out /etc/ssl/private/pure-ftpd.pem – TheNiceGuy Dec 8 '13 at 2:17
  • It's best to provide the output of errors when you're having issues. I'm guessing your issue is because of -signkey. This is not a valid openssl req option on my system. The error message will have this as the very first line: unknown option -signkey – Patrick Dec 8 '13 at 3:36
  • Well that signkey should tell SSL to use the provided key as i know? – TheNiceGuy Dec 8 '13 at 3:53
  • Your "normal way to create the certificate" doesn't prompt for any data. Are you not wanting it to output anything? Then use 2> /dev/null. – wingedsubmariner Dec 8 '13 at 5:50
49

The thing you're missing is to include the certificate subject in the -subj flag. I prefer this to creating a config file because it's easier to integrate into a workflow and doesn't require cleaning up afterward.

One step key and csr generation:

openssl req -new -newkey rsa:4096 -nodes \
    -keyout www.example.com.key -out www.example.com.csr \
    -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"

One step self signed passwordless certificate generation:

openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
    -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \
    -keyout www.example.com.key  -out www.example.com.cert

Neither of these commands will prompt for any data.

See my answer to this nearly identical question on Super User.

  • O well that's a nice solution. Makes the codes much smaller. Thanks :D – TheNiceGuy Dec 9 '13 at 0:23
  • 1
    I didn't modify his original config file, as I thought it might be a standin for a more complicated certificate. Some configurations that cannot be represented with a -subj parameter, particularly when you get into v3 extensions and subjectAltName parameters. – robbat2 Dec 9 '13 at 2:02
  • 1
    You can also use -batch (non-interactive mode) – Eran H. Nov 5 '18 at 8:26
  • Note the first command seems to require the key to exist before it can be executed where the second command creates they key and cert automatically because the -subj is a basic valid in-line CSR. – dragon788 Jan 4 at 19:04
  • @dragon788 Thanks for pointing that out. I fixed it. – bahamat Jan 10 at 1:22
1

The command you are looking for is:

openssl req -new -x509 -config openssl.cnf -nodes -days 7300 -key server.key -out /etc/ssl/private/pure-ftpd.pem

Changes from your version:

  • -new is required to generate anything
  • -key used in place of -signkey

Not the answer you're looking for? Browse other questions tagged or ask your own question.