Error when trying to add custom extensions to X509 certificates using openSSL

opensslself-signed-certificatex509

I am trying to add custom extensions to my self-signed certificate.
I tried the following

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -extfile myconfig.cnf -extensions v3_req

Error is

unknown option -extfile

myconfig.cnf

[req]
req_extensions = v3_req

[v3_req]
1.2.3.4.5.6.7.8=ASN1:UTF8String:Something

when I remove -extfile myconfig.cnf -extensions v3_req, I see cert.pem created successfully.

I do see -extfile is not a valid option. However, I see other posts suggesting the same
Openssl Custom Extension

EDIT

I used -config instead of -extfile but I get the following error

unable to find 'distinguished_name' in config
problems making Certificate Request
4646921836:error:0EFFF06C:configuration file routines:CRYPTO_internal:no value:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.260.1/libressl-2.6/crypto/conf/conf_lib.c:322:group=req name=distinguished_name

Best Answer

Your configuration file contains two small errors:

  1. When called with -x509 req does not look for the req_extensions, but the x509_extensions section,
  2. Your configuration file does not contain a distinguished name attribute, which is the only certificate attribute without a default value.

Therefore a minimal configuration file would look like this:

[ req ]
distinguished_name = dn
x509_extensions = extensions
prompt = no

[ extensions ]
1.2.3.4 = ASN1:UTF8String:Something

[ dn ]
0.DC = com
1.DC = example
commonName = example.com

The prompt option disables prompting for the distinguished name RDNs. You can generate your certificate with:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem\
-days 365 -config myconfig.cnf

A more complete example should, of course, include some standard extensions in the [ extensions ] section, which you can find in the standard OpenSSL config:

# PKIX recommendation.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = critical,CA:true
Related Topic