Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to create a PKCS#10 certificate request / X.509 certificate with the identifying information only in the subject alternate name attribute/extension? According to X.509 Subject, the subject can be empty for a certificate whose subject is not a CA as long as the subjectAltName is critical.

But when I use this config file with an empty distinguished_name section:

# request.config
[ req ]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no

[ req_distinguished_name ]

[ v3_req ]
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

and commands

openssl genrsa 1024 > key.pem
openssl req -new -key key.pem -out req.pem -config request.config

OpenSSL complains:

error, no objects specified in config file
problems making Certificate Request
share|improve this question
up vote 2 down vote accepted

This worked for me:

test-no-cn.cnf file

default_bits       = 4096
encrypt_key        = no
default_md         = sha256
distinguished_name = req_distinguished_name
req_extensions = v3_req

[ req_distinguished_name ]

[ v3_req ]
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

O=My Example Organization
OU=My Example Unit
CN=My Example Name

Generate the CSR

openssl req -new -newkey rsa:4096 -nodes -config test-no-cn.cnf -subj "/" -outform pem -out test-no-cn.csr -keyout test-no-cn.key

Sign the CSR

openssl x509 -req -days 365 -in test-no-cn.csr -signkey test-no-cn.key -out test-no-cn.crt -outform der -extensions v3_req -extfile test-no-cn.cnf

View the resulting certificate

openssl x509 -inform der -in test-no-cn.crt -noout -text
share|improve this answer

I also ran into this "no objects specified" error. It was displaying a prompt like this for various fields:

US []:

And I was just pressing enter because I had already set these values in the .cnf file. It turns out I needed to type all the values again, and then it worked.

share|improve this answer
I had to do the same. Despite putting values in the config file, it still prompted me for all the DN components again. I had to repeat them, but it worked at least. – Nate W. Sep 3 '14 at 17:50
This is because the config file did not actually contain default values. C = US means that the "prompt" for C is "US", not the default value. Instead, the file should contain C = Country and C_default = US. – jordanbtucker Oct 14 '14 at 22:55
Oh, and that's only if prompt = yes [or blank]. If prompt = no then C = US would mean "US" is the default value. – jordanbtucker Oct 14 '14 at 23:06

Try "commonName = optional" in policy sections in openssl configuration file.

share|improve this answer

It seems you enter any single one value from '"distinguished_name" group from your keyboard and it works fine...I mean you do not need to enter other values and can use their default(as mentioned in openssl.conf file) that said

[ req ]
distinguished_name = req_distinguished_name
prompt = no

Should work fine.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.