How to create ECDSA keypair based on OpenSSL config file?

Question

When generating CSRs based on RSA key-pairs I'm using the OpenSSL req command for convenience:

openssl req -new -noenc -config 'server.cert.conf' -keyout 'private/server.key.pem' -out 'server.csr.pem'

I like to put the details into a config file, which looks something like this:

[ req ]
prompt = no
utf8 = yes
default_bits = 2048
default_md = sha256
distinguished_name = req_distinguished_name
req_extensions = req_extensions

[ req_distinguished_name ]
CN = foo.example.net

[ req_extensions ]

subjectAltName=@alt_names

[ alt_names ]
DNS.1 = foo.example.net
DNS.2 = bar.example.net

Now I want to work with ECDSA keys instead, but haven't found a way to put all the necessary parameters into the config file. Instead, I have to invoke several OpenSSL commands and specify some parameters as command arguments:

$ openssl genpkey -genparam -algorithm ec -pkeyopt ec_paramgen_curve:secp384r1 -out server.key.params.pem
$ openssl genpkey -paramfile server.key.params.pem -out private/server.key.pem
$ openssl req -new -config 'server.cert.conf' -key 'private/server.key.pem' -out 'server.csr.pem'

Alternatively, I can skip the second genpkey command, but I'd still need a param file:

$ openssl req -new -config 'server.cert.conf' -noenc -newkey 'param:server.key.params.pem' -keyout 'private/server.key.pem' -out 'server.csr.pem'

Is there any way to move all the public key algorithm specific configuration (such as EC curve selection) into the config file for the CSR?

Ideally, I'd like to run the exact same OpenSSL req command from the beginning of my question for both RSA and ECDSA keys. And externalize all the details into the config file. Including the decision which public key algorithm to use in the first place.

---

I've read all the OpenSSL man pages and searched for answers here and elsewhere on the web. But I haven't found anything so far.

My impression is, that OpenSSL is rather inconsistent when it comes to CLI options and config-file options. Some stuff (like subject alt names) can only be controlled through config files, while other stuff (like EC curves) can only be configured through CLI args. Hope someone can prove me wrong about the latter.

I've tried to use some of the CLI options in the config file instead, but OpenSSL simply ignores them. Tested several variations of these lines so far:

default_bits = ec:server.key.params.pem
default_newkey = ec:server.key.params.pem
pkeyopt = ec_paramgen_curve:secp384r1

Answer 1

No, there isn't. The req subcommand doesn't read 'keyalg' from config, only from the -newkey option.

• https://github.com/openssl/openssl/blob/master/apps/req.c#L232

However, you can avoid the param file:

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 > foo.priv
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 > foo.priv

GnuTLS certtool -q can be used to generate a keypair and a request in one step.