Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am using following code to generate keys:

apt-get -qq -y install openssl;
mkdir -p /etc/apache2/ssl;
openssl genrsa -des3 -out server.key 1024;
openssl req -new -key server.key -out server.csr;
cp server.key server.key.org;
openssl rsa -in server.key.org -out server.key;
openssl x509 -req -days 12000 -in server.csr -signkey server.key -out server.crt;
mv server.crt  /etc/apache2/ssl/cert.pem;
mv server.key  /etc/apache2/ssl/cert.key;
rm -f server.key.orig;
rm -f server.csr

1) How can I skip the passphrase prompting? Would it be reasonably safe for me to do so? (as in it should not be downright foolish like anyone should be able to hack the certificate)

2) How do I avoid the prompting for the country name, organization etc. I hope I can give them on command prompt (the man page shows only top level options for openssl)



share|improve this question

3 Answers 3

up vote 57 down vote accepted

You can supply all of that information on the command line.

One step self signed passwordless certificate generation:

openssl req \
    -new \
    -newkey rsa:4096 \
    -days 365 \
    -nodes \
    -x509 \
    -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \
    -keyout www.example.com.key \
    -out www.example.com.cert

All of the openssl subcommands have their own man page. See man req.

Specifically addressing your questions and to be more explicit about exactly which options are in effect:

  1. The -nodes flag signals to not encrypt the key, thus you do not need a password. You could also use the -passout arg flag. See PASS PHRASE ARGUMENTS in the openssl(1) man page for how to format the arg.

  2. Using the -subj flag you can specify the subject (example is above).

share|improve this answer
Works like a charm. Thanks! –  JP19 Dec 28 '10 at 5:54
Reading stuff via "-subj" works great, however - for me - only when OPENSSL_CONF is NOT set. IOW: if OPENSSL_CONF is set, OpenSSL will try reading from there, and ignore "-subj" command line argument. Took me a while to figure out. –  oberstet Mar 27 '12 at 21:17
oberstet: Yes, that is true. –  bahamat Mar 30 '12 at 21:48
Is it possible to pass the subject key itself from stdin? I have tried "-key stdin", "-key fd:1" and "-key -" .. with no luck. –  oberstet Apr 3 '12 at 1:39
I have split out the Q: superuser.com/questions/407874/… –  oberstet Apr 3 '12 at 17:07

Doesn't -passin option do the trick for you?

With file:pathname form you can be quite safe with permissions 600 for that file.

share|improve this answer
Saw the option in man page. Looks like I can have the passphrase that way without prompting. Thanks! –  JP19 Dec 28 '10 at 6:01

Try the following command:

openssl genrsa -des3 -out user.key -passout pass:foo 1024

The skipping part is: -passout pass:foo.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.