Avoid password prompt for keys and prompts for DN information

Question

I am using following code to generate keys:

apt-get -qq -y install openssl;
mkdir -p /etc/apache2/ssl;
openssl genrsa -des3 -out server.key 1024;
openssl req -new -key server.key -out server.csr;
cp server.key server.key.org;
openssl rsa -in server.key.org -out server.key;
openssl x509 -req -days 12000 -in server.csr -signkey server.key -out server.crt;
mv server.crt  /etc/apache2/ssl/cert.pem;
mv server.key  /etc/apache2/ssl/cert.key;
rm -f server.key.orig;
rm -f server.csr

I have two questions:

How can I skip the passphrase prompting? Would it be reasonably safe for me to do so? (as in it should not be downright foolish like anyone should be able to hack the certificate)
How do I avoid the prompting for the country name, organization etc. I hope I can give them on command prompt (the man page shows only top level options for OpenSSL)

bahamat · Accepted Answer · 2016-10-25T20:24:49.390

177

Edit: This is by far my most popular answer, and it's been a few years on now so I've added an ECDSA variant. If you can use ECDSA you should.

You can supply all of that information on the command line.

One step self-signed password-less certificate generation:

RSA Version

openssl req \
    -new \
    -newkey rsa:4096 \
    -days 365 \
    -nodes \
    -x509 \
    -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \
    -keyout www.example.com.key \
    -out www.example.com.cert

ECDSA version

openssl req \
    -new \
    -newkey ec \
    -pkeyopt ec_paramgen_curve:prime256v1 \
    -days 365 \
    -nodes \
    -x509 \
    -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \
    -keyout www.example.com.key \
    -out www.example.com.cert

All of the openssl subcommands have their own man page. See man req.

Specifically addressing your questions and to be more explicit about exactly which options are in effect:

The -nodes flag signals to not encrypt the key, thus you do not need a password. You could also use the -passout arg flag. See PASS PHRASE ARGUMENTS in the openssl(1) man page for how to format the arg.
Using the -subj flag you can specify the subject (example is above).

edited Oct 25 '16 at 20:24

answered Dec 27 '10 at 19:44

bahamat

5,646
1
26
26

3

Reading stuff via "-subj" works great, however - for me - only when OPENSSL_CONF is NOT set. IOW: if OPENSSL_CONF is set, OpenSSL will try reading from there, and _ignore_ "-subj" command line argument. Took me a while to figure out. – oberstet Mar 27 '12 at 21:17
oberstet: Yes, that is true. – bahamat Mar 30 '12 at 21:48
Is it possible to pass the subject _key_ itself from stdin? I have tried "-key stdin", "-key fd:1" and "-key -" .. with no luck. – oberstet Apr 03 '12 at 01:39
I have split out the Q: http://superuser.com/questions/407874/openssl-csr-generation-with-subject-key-from-stdin – oberstet Apr 03 '12 at 17:07
Does this support a wildcard? – Cerin Nov 11 '13 at 17:45
If you mean a wildcard CN, it should. Although I haven't tried it. – bahamat Nov 11 '13 at 21:33
Is it possible to specify the `-CA` and `-CAkey` options in this single step command? I'd like to sign it using my CA files. – Jeremy Baker Jun 09 '15 at 18:00
1

@JeremyBaker: No, you'll need a two step process for that. Omit the `-x509` and `-days` to generate a CSR instead of a certificate then use your usual CA signing method. – bahamat Jun 09 '15 at 18:07
This is not quite correct: `-subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"` You can't [properly] set the server's name from the command line. To place the server name in the *Subject Alternate Name*, you must use a OpenSSL configuration file. Otherwise, the server name is placed in the *Common Name* and the certificate will not validate under browsers. – jww Dec 18 '16 at 02:07
@jww SAN is not required. Browsers will validate the subject CN just fine. *Subject Alternate Name*, as its name implies is an *alternate name* for the *subject* field. – bahamat Dec 18 '16 at 05:29
@bahamat - Citation, please. Here's the document that tells us the SAN is required: [CA/Browser forum Baseline Requirements](https://cabforum.org/baseline-requirements-documents/); section 7.4. the same document tells us the CN is deprecated but not forbidden (yet). – jww Dec 18 '16 at 05:31
2

@jww - and that time has come. Starting with Chrome v58, when attempting to load a secure page but the certificate doesn't contain a matching subjectAltName, it shows a privacy error page with the error message "NET::ERR_CERT_COMMON_NAME_INVALID". Clicking on the advanced button shows the message "... its security certificate is from [missing_subjectAltName]" – Insomniac Software May 04 '17 at 10:52
The state of denial is a nice touch :-) – Redzarf Dec 31 '19 at 15:08

score 12 · Answer 2 · answered Dec 27 '10 at 19:54

12

Doesn't -passin option do the trick for you?

With file:pathname form you can be quite safe with permissions 600 for that file.

answered Dec 27 '10 at 19:54

9000

425
2
4
14

Saw the option in man page. Looks like I can have the passphrase that way without prompting. Thanks! – Dec 28 '10 at 06:01
And with `-passin 'pass:YOUR_PASSWORD'`? - doc: https://www.openssl.org/docs/man1.0.2/apps/openssl.html#PASS-PHRASE-ARGUMENTS – andras.tim Nov 06 '18 at 11:29
to be clear for others, **-passin** is the password used for a file that will contain your key (and requires a file/path), and **-passout** is the password for the file of the key that is generated by the openssl req command. If you want to have the password contained in the single req command you use **-passout**, if you want to reference the key in the command from a file and that is password-protected, you use **-passin**. Both override the configuration file options if you are using one, so be aware. – danno Feb 15 '23 at 19:20

Andrei Sura · Answer 3 · 2016-06-09T17:44:40.413

7

The accepted answer needs a couple of small corrections. EC Lines:

-newkey ec
-pkeyopt ec_paramgen_curve:prime256v1

should be:

 -newkey ec \
 -pkeyopt ec_paramgen_curve:prime256v1 \

On MacOS - OpenSSL 1.0.2f installed via brew I verified the the accepted answer as described below

To list available Elliptic curves:
```
$ openssl ecparam -list_curves
```

To generate a key file:

$ openssl ecparam -name secp256k1 -out secp256k1.pem

To generate the cert without password prompt:

openssl req \
    -new \
    -newkey ec:secp256k1.pem \
    -days 365 \
    -nodes \
    -x509 \
    -subj "/C=US/ST=FL/L=Ocala/O=Home/CN=example.com" \
    -keyout server.key \
    -out server.crt

To view the cert:

$ openssl x509 -noout -text -in server.crt

edited Jun 09 '16 at 17:44

answered Jun 08 '16 at 19:28

Andrei Sura

217
2
4

How is this different from the accepted answer? – Ramhound Jun 08 '16 at 22:53
1

The only important difference is that I explicitly list the step of generating the pem file. The accepted answer is missing the two \ characters and it made me think that the command is incorrect. – Andrei Sura Jun 09 '16 at 15:32
1

You might want to mention that fact. If the accepted answer is indeed incomplete, and is missing characters, important to highlight the differences and how your answer contains important significant information. – Ramhound Jun 09 '16 at 17:20

kenorb · Answer 4 · 2014-01-16T17:27:39.880

4

Try the following command:

openssl genrsa -des3 -out user.key -passout pass:foo 1024

The skipping part is: -passout pass:foo.

edited Jan 16 '14 at 17:27

answered Jan 16 '14 at 17:16

kenorb

24,736
27
129
199

What is `foo` ? – Chaminda Bandara Nov 12 '20 at 20:02
@ChamindaBandara `foo` is an example password for demonstration – ajmeese7 Jun 12 '22 at 17:12

score 2 · Answer 5 · answered Feb 20 '16 at 08:06

@bahamat has a great answer. Unfortunately some versions of openssl throw an error when trying to create an ECDSA certificate with one command. The error goes something like:

routines:EVP_PKEY_CTX_ctrl:invalid operation:pmeth_lib.c:404

I was using openssl 1.0.1e-fips on CentOS 7.

Creating your certificate with the following 3 commands seems to work:

openssl ecparam -genkey -name prime256v1 -out key.pem
openssl req -new -key key.pem -out csr.pem -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"
openssl req -x509 -days 365 -key key.pem -in csr.pem -out certificate.pem

Shouldn’t the last line end with `server.crt`? – ᴠɪɴᴄᴇɴᴛ Dec 08 '16 at 20:22 — ᴠɪɴᴄᴇɴᴛ, Dec 08 '16 at 20:22

NotoriousPyro · Answer 6 · 2022-09-05T12:58:40.603

Personally I don't like the top answer by providing loads of parameters, it's hard to read. Thankfully OpenSSL provides a config parameter, so the generation of a certificate without password prompts can be done easier and in a more readable and reliable way:

Generate the key:

openssl genrsa 2048 > localhost.key

Create the config openssl.cnf

[dn]
CN=localhost

[req]
distinguished_name = dn
prompt = no

[alt_names]
DNS.1 = localhost
DNS.2 = 127.0.0.1

[v3_ca]
subjectAltName=@alt_names
keyUsage=digitalSignature
extendedKeyUsage=serverAuth

Generate the certificate:

openssl req -x509 -new -out localhost.crt -key localhost.key -config openssl.cnf -days 11499 -nodes -extensions v3_ca -sha256

Alternatively with a CSR:

Generate a new CSR:

openssl req -new -out localhost.csr -key localhost.key -config openssl.cnf

View the data in the CSR:

openssl req -in localhost.csr -text -noout

 Certificate Request:
     Data:
         Version: 1 (0x0)
         Subject: CN = localhost
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (2048 bit)
                 Modulus:
                     [...]
                     67:9f
                 Exponent: 65537 (0x10001)
         Attributes:
             (none)
             Requested Extensions:
     Signature Algorithm: sha256WithRSAEncryption
     Signature Value:
         [...]

Generate the certificate:

openssl x509 -req -days 11499 -in localhost.csr -signkey localhost.key -out localhost.crt -extensions v3_ca -extfile openssl.cnf -sha256

View the data in the certificate: openssl x509 -in localhost.crt -text -noout

 Certificate:
     Data:
         Version: 3 (0x2)
         Serial Number:
             2b:1e:48:e4:58:19:b4:5e:50:c5:45:6d:0b:3d:07:c8:c5:26:86:cb
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: CN = localhost
         Validity
             Not Before: Sep  5 11:29:05 2022 GMT
             Not After : Feb 28 11:29:05 2054 GMT
         Subject: CN = localhost
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (2048 bit)
                 Modulus:
                     [...]
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Alternative Name:
                 DNS:localhost, DNS:127.0.0.1
             X509v3 Key Usage:
                 Digital Signature
             X509v3 Extended Key Usage:
                 TLS Web Server Authentication
             X509v3 Subject Key Identifier:
                 5D:72:9B:F4:3E:76:37:15:81:59:28:10:97:A7:A9:5E:37:D9:C5:EF
     Signature Algorithm: sha256WithRSAEncryption
     Signature Value:
         [...]

score 0 · Answer 7 · edited Apr 12 '23 at 20:17

0

https://linux.die.net/man/1/openssl use -passin env:var

Example

export PASSIN="mycertsecretpass"
openssl pkcs12  -passin env:PASSIN -in ${cn}.pfx -nocerts -nodes > ${cn}.key.pem

edited Apr 12 '23 at 20:17

Rohit Gupta

2,721
18
27
35

answered Apr 12 '23 at 18:09

Jeremy Busk

41
2

score 0 · Answer 8 · answered Aug 29 '23 at 20:19

If you are creating a self-signed certificate to test HTTPS, then you will probably need to add x509 v3 extensions (most notably, subjectAltName) for it to work in most mainstream browsers, but you can also specify them on the terminal (as of OpenSSL 1.1.1):

openssl req -x509 -new -nodes                                      \
  -newkey RSA:2048                                                 \
  -days 365                                                        \
  -subj '/C=US/ST=Denial/L=Earth/O=Dis/CN=anything_but_whitespace' \
  -addext 'subjectAltName = DNS:localhost'                         \
  -addext 'authorityKeyIdentifier = keyid,issuer'                  \
  -addext 'basicConstraints = CA:FALSE'                            \
  -addext 'keyUsage = digitalSignature, keyEncipherment'           \
  -addext 'extendedKeyUsage=serverAuth'                            \
  -out self-signed.crt                                             \
  -keyout private.key

(This won't work in Firefox though.)

Avoid password prompt for keys and prompts for DN information

8 Answers8

Linked

Related