I want to use openssl to create a CSR while providing some of the answers for Country Name, State or Province Name, etc but I still want it to prompt for the Common Name (FQDN). So far I have something like:
openssl req -new -sha256 -key example.com.key -out example.com.csr -subj "/C=US/ST=Ohio/L=Columbus/O=Widgets Inc/OU=Some Unit"
This however does not prompt me for the Common name. What is the proper way to do this?
You can do it on the command line with read and using the result variable in your openssl command:
read -p "FQDN? " cn; openssl req -new -newkey rsa:2048 -sha256 -nodes -keyout $cn.key -subj "/CN=$cn\/emailAddress=admin@$cn/C=US/ST=Ohio/L=Columbus/O=Widgets Inc/OU=Some Unit" -out $cn.csr
If this is something you do often, make it a function and add it to your .bashrc file, which allows you to replace the prompt with an argument:
function csr { openssl req -new -newkey rsa:2048 -sha256 -nodes -keyout $1.key -subj "/CN=$cn\/emailAddress=admin@$1/C=US/ST=Ohio/L=Columbus/O=Widgets Inc/OU=Some Unit" -out $1.csr }
Then envoke it whenever you need to like so:
csr example.com
The following openssl.conf file does almost the same thing:
[req]
default_bits=2048
encrypt_key=no
default_md=sha256
distinguished_name=req_subj
[req_subj]
commonName="Fully Qualified Domain Name (FQDN)"
emailAddress="Administrative Email Address"
countryName="Country Name (2 letter code)"
countryName_default=US
stateOrProvinceName="State Name (full name)"
stateOrProvinceName_default=Ohio
localityName="Locality Name (e.g., city)"
localityName_default=Columbus
organizationName="Organization Name (e.g., company)"
organizationName_default=Widgets Inc
organizationalUnitName="Organizational Unit Name (e.g., section)"
organizationalUnitName_default=Some Unit
Then either set your OPENSSL_CONF environment variable to that file
export $OPENSSL_CONF=~/.dotfiles/openssl.conf
or specify it via switch on the CLI
openssl req -new -config openssl.conf -keyout example.key -out example.csr
I say almost because it still prompts you for those attributes, but they're now the default so you can just hammer the Return key to the end after specifying the domain and your email.
I'm not sure if there's a way to do that from only command line values. I have always used the config file to accomplish this. For example the entries to set the defaults in your config might look like:
policy = policy_anything
# For the 'anything' policy, which defines allowed DN fields
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
commonName = supplied
name = optional
emailAddress = optional
####################################################################
# request handling
[ req ]
default_bits = 2048
default_keyfile = private/key.pem
default_md = default
distinguished_name = standard_dn
####################################################################
# DN (Subject) handling
[ standard_dn ]
countryName = Country Name (2 letter code)
countryName_default = US
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = California
localityName = Locality Name (eg, city)
localityName_default = Beverily Hills
commonName = Common Name (eg, YOUR name)
commonName_default = John Smith
commonName_max = 64
emailAddress = Email Address
emailAddress_default = [email protected]
emailAddress_max = 64
Many years ago I wrote this BASH script because I was creating so many CSRs. If you look closely, you can see how I added the FQDN (host name) as the CN (common name) on the CSR. This script skips the CSR portion and calls openssl with the "req" and "-x509" options, so it generates a self signed cert instead of a CSR. But it shows how you can construct a SN with a FQDN on the end as a CN. It's released under a BSD license, so feel free to use any portion of it. Specifically, you could probably change the last section to something like this, if you want the CSR:
# Now create the CSR
if [ 0 = ${#PASSWORD} ]; then
openssl req -new -batch -key $CN.key -subj "$SN" -out $CN.crt
else
openssl req -new -batch -key $CN.key -subj "$SN" -out $CN.crt \
-passin "pass:$PASSWORD"
fi
from: https://gist.github.com/OhMeadhbh/6201808
#!/bin/bash
# Copyright (c) 2003-2013, Meadhbh S. Hamrick. All Rights Reserved.
# Released under a BSD License. See http://opensource.org/licenses/BSD-2-Clause
#
# This script uses openssl to generate a self-signed certificate. Usage is
# like this:
# gssc <host name> [-p password] [-s subject] [-b bitlength]
# The host name parameter is the subject name of the certificate; i.e. - the
# FQDN of the host you're generating a certificate for. This is also the base
# name for the key, certificate signing request and certificate files. If you
# want the key to be protected by a password, use the -p option to specify
# it. The subject name of the requested cert defaults to:
# "C=US, ST=California, L=Felton, CN=<host name>"
# You can select a differetn subject name by using the -s option and providing
# a complete openssl style subject name. For example:
# "/C=IO/ST=Chagos/L=Diego Garcia/CN=foo.bar.mil"
# will specify the expected subject name. Remember to put the slashes
# in front of each clause and to put the Common Name (CN) entry (we don't
# do it for you.) By default, we generate 2048 bit RSA keys. If you want some
# other bit length, use the -b flag.
#
# For example, the following command generates a self signed cert for the
# machine "secure.example.com" with a 1536 bit RSA key and a common name of
# "C=US, ST=Montana, L=Bozeman, CN=secure.example.com":
# gssc secure.example.com -b 1536 -password "badpassword" \
# -s "/C=US/ST=Montana/L=Bozeman/CN=secure.example.com"
#
# This example creates a self signed cert for www.example.org with no password
# on the private key and a subject name of "C=US, ST=California, L=Felton,
# CN=www.example.org":
# fssc www.example.com
#
# Cheers!
# Check to see if we provided a host name
if [ $# -lt 1 ]; then
echo "Usage: $0 <host name> [-b bits] [-p password] [-s subject name]"
exit 1
fi
# Set up defaults
CN=$1
BITS=2048
PASSWORD=""
SN="/C=US/ST=California/L=Felton/CN=$1"
# Now apply the parameters
shift
while getopts "b:p:s:" flag
do
case $flag in
b) BITS=$OPTARG;;
p) PASSWORD=$OPTARG;;
s) SN=$OPTARG;;
esac
done
# First off, generate a RSA key
if [ 0 = ${#PASSWORD} ]; then
openssl genrsa -out $CN.key $BITS
else
if [ 4 -gt ${#PASSWORD} ]; then
echo "Your pass phrase must be four or more characters."
exit 2
else
openssl genrsa -out $CN.key -des3 -passout "pass:$PASSWORD" $BITS
fi
fi
# Now create the certificate
if [ 0 = ${#PASSWORD} ]; then
openssl req -new -batch -x509 -key $CN.key -subj "$SN" -days 365 -out $CN.crt
else
openssl req -new -batch -x509 -key $CN.key -subj "$SN" -days 365 -out $CN.crt \
-passin "pass:$PASSWORD"
fi
