Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to create a PKCS#10 certificate request / X.509 certificate with the identifying information only in the subject alternate name attribute/extension? According to X.509 4.1.2.6 Subject, the subject can be empty for a certificate whose subject is not a CA as long as the subjectAltName is critical.

But when I use this config file with an empty distinguished_name section:

# request.config
[ req ]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no

[ req_distinguished_name ]

[ v3_req ]
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName=critical,email:certtest@example.com

and commands

openssl genrsa 1024 > key.pem
openssl req -new -key key.pem -out req.pem -config request.config

OpenSSL complains:

error, no objects specified in config file
problems making Certificate Request
share|improve this question
up vote 2 down vote accepted

This worked for me:

test-no-cn.cnf file

[req] 
default_bits       = 4096
encrypt_key        = no
default_md         = sha256
distinguished_name = req_distinguished_name
req_extensions = v3_req

[ req_distinguished_name ]

[ v3_req ]
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName=critical,email:certtest@example.com,URI:http://example.com/,IP:192.168.7.1,dirName:dir_sect

[dir_sect]
C=DK
O=My Example Organization
OU=My Example Unit
CN=My Example Name

Generate the CSR

openssl req -new -newkey rsa:4096 -nodes -config test-no-cn.cnf -subj "/" -outform pem -out test-no-cn.csr -keyout test-no-cn.key

Sign the CSR

openssl x509 -req -days 365 -in test-no-cn.csr -signkey test-no-cn.key -out test-no-cn.crt -outform der -extensions v3_req -extfile test-no-cn.cnf

View the resulting certificate

openssl x509 -inform der -in test-no-cn.crt -noout -text
share|improve this answer

I also ran into this "no objects specified" error. It was displaying a prompt like this for various fields:

US []:

And I was just pressing enter because I had already set these values in the .cnf file. It turns out I needed to type all the values again, and then it worked.

share|improve this answer
    
I had to do the same. Despite putting values in the config file, it still prompted me for all the DN components again. I had to repeat them, but it worked at least. – Nate W. Sep 3 '14 at 17:50
1  
This is because the config file did not actually contain default values. C = US means that the "prompt" for C is "US", not the default value. Instead, the file should contain C = Country and C_default = US. – jordanbtucker Oct 14 '14 at 22:55
3  
Oh, and that's only if prompt = yes [or blank]. If prompt = no then C = US would mean "US" is the default value. – jordanbtucker Oct 14 '14 at 23:06

Try "commonName = optional" in policy sections in openssl configuration file.

share|improve this answer

It seems you enter any single one value from '"distinguished_name" group from your keyboard and it works fine...I mean you do not need to enter other values and can use their default(as mentioned in openssl.conf file) that said

[ req ]
...
distinguished_name = req_distinguished_name
prompt = no
...

Should work fine.
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .