1

Have set of windows batch scripts as an automatized environment. Trying to include openvpn client certificates generating into this environment. Got inspiration in EasyRSA 2.x which includes set of batch scripts assembling openssl.exe parameters to certificate generating hadling.

Wanna avoid usage of -config file.cfg for good reasons, and trying to write all necessary variables as a content of console -config parameter. According third option here this should be possible but did not found any example and linked man page does not contain any syntax explanation and is linux oriented. Commands I want to script:

rem creating request for new certificate
"%HOME%\..\bin\openssl.exe" req -key rsa:2048 -days 3650 -nodes -keyout "%HOME%\keys\%NAME_CN%.key" -out "%HOME%\keys\%NAME_CN%.csr"  -subj "/C=%KEY_COUNTRY%/ST=%KEY_PROVINCE%/L=%KEY_CITY%/O=%KEY_ORG%/OU=%KEY_OU%/CN=%NAME_CN%" 

rem signing request by certification authority key, creating cert/key pair
"%HOME%\..\bin\openssl.exe" ca -days 3650 -cert -out "%HOME%\keys\%NAME_CN%.crt" -in "%HOME%\keys\%NAME_CN%.csr"

rem check if created client certificate is valid
"%HOME%\..\bin\openssl.exe" verify -CAfile "%HOME%\keys\%CA_CRT%.crt" -purpose sslclient "%HOME%\keys\%NAME_CN%.crt"

first two command give me following error:

Ignoring -days; not generating a certificate
Can't open /etc/ssl/openssl.cnf for reading, No such file or directory
2124:error:02001003:system library:fopen:No such process:crypto/bio/bss_file.c:69:fopen('/etc/ssl/openssl.cnf','r'
)

As a total last resort I could create minimalistic cfg file with few well commented variables, all variables possible to be writen on command line should be there. Anyone could kick me to right direction please?

Improve this question
6
  • You must have a openssl.cnf file, but as you say it can be minimal.
    – garethTheRed
    Commented Dec 31, 2020 at 15:57
  • Are you sure? Someone here security.stackexchange.com/a/198409 says -config option is no longer needed, but this talk is about req -x509 If config file is REALLY still needed, could someone help me to create minimalistic one for my request? Spend LOT if time with googling, but as I do not understand cryptography, many terms are still too strange for me.
    – user2956477
    Commented Dec 31, 2020 at 16:53
  • Normally, the installation of OpenSSL installs a generic/default openssl.cnf file. The trick in the answer you linked to was using command line options to override the values in the config file so that you don't need to edit it, or even know where it is.
    – garethTheRed
    Commented Dec 31, 2020 at 18:26
  • so openssl always check for existence of config file, and this feature could not be turned off by providing all necessary options on commandline?
    – user2956477
    Commented Jan 1, 2021 at 7:34
  • Another person here securitypad.blogspot.com/2018/05/summary-you-need-openssl.html says: "OpenSSL commands (that is, the ones invoked from the command line) are mostly controlled by their options. But in order to issue X.509 certificates or CSRs OpenSSL needs a configuration file" So this look like config file is needed only for SOME operations.
    – user2956477
    Commented Jan 1, 2021 at 7:44

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .