2

I know that when working with openssl you can bypass the interactive input by:

  • -passin pass:whatever
  • -passout pass:whatever
  • -subj "/C=pa/ST=pa/L=pa/O=pa/OU=pa/CN=pa"

However when signing a certificate, like with:

openssl ca -config intermediate/openssl.cnf \
        -passin pass:whatever \
        -extensions usr_cert -days 375 -notext -md sha256 \
        -in intermediate/csr/www.example.com.csr.pem \
        -out intermediate/certs/www.example.com.cert.pem

I need enter "y" twice:

            ....
            X509v3 Authority Key Identifier: 
                keyid:96:7B:52:E6:FC:53:53:F0:F3:D1:B3:EB:FB:5C:95:4D:73:BD:B8:5D

            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, E-mail Protection

Certificate is to be certified until Jul 12 14:00:14 2017 GMT (375 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Is there a openssl commandline switch that automates this?

1 Answer 1

2

From man ca:

   -batch
       this sets the batch mode. In this mode no questions will be asked
       and all certificates will be certified automatically.

As an aside, man openssl has this to say about using pass: for the pass phrase argument:

   pass:password
             the actual password is password. Since the password is
             visible to utilities (like 'ps' under Unix) this form should
             only be used where security is not important.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .