How to read certificate information automatically using OpenSSL

apache-2.4opensslubuntu-14.04

To generate an SSL certificate file for Apache, I am using the below command:

 openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.cert

And I manually feed it with these parameters:

Country Name (2 letter code) [AU]:AU
State or Province Name (full name): Myname
[Some-State]:Some-State
Locality Name (eg, city) []:City
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Internet
Organizational Unit Name (eg, section) []:Section
Common Name (e.g. server FQDN or YOUR name) []:yourname
Email Address []:email@gmail.com

Is it possible to enter them from a file or right from an OpenSSL command line using options?

There is no hint from the OpenSSL man pages.

Best Answer

You can create a configuration file and use that in your command. You could for example create a config file named openssl.cnf and use it like this:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.cert -config ./openssl.cnf

In your case you can set the following parameters:

[ req_distinguished_name ]
# Variable name             Prompt string
#-------------------------    ----------------------------------
0.organizationName          = Organization Name (company)
organizationalUnitName          = Organizational Unit Name (department, division)
emailAddress                = Email Address
emailAddress_max            = 40
localityName                = Locality Name (city, district)
stateOrProvinceName         = State or Province Name (full name)
countryName             = Country Name (2 letter code)
countryName_min             = 2
countryName_max             = 2
commonName              = Common Name (hostname, IP, or your name)
commonName_max              = 64

More can be found at http://www.flatmtn.com/article/setting-openssl-create-certificates#SSLCert-4

Related Topic