Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a lot of keys to generate for my clients VPN server. Whenever I use easy-rsa to generate the keys like this:

./build-key client1

There is some output with a series of questions. The questions all have default answers that are defined in the vars file.

Generating a 1024 bit RSA private key
writing new private key to 'client1.key'
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [US]:
State or Province Name (full name) [CO]:
Locality Name (eg, city) [Denver]:
Organization Name (eg, company) [mycompany]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) [client1]:
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'US'
stateOrProvinceName   :PRINTABLE:'CO'
localityName          :PRINTABLE:'Denver'
organizationName      :PRINTABLE:'mycompany'
commonName            :PRINTABLE:'client1'
emailAddress          :IA5STRING:''
Certificate is to be certified until Jan  3 20:16:04 2038 GMT (9999 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

All in all, I have to manually press the following keys:


Basically I'm just accepting all default answers and saying 'yes' to the final two questions. Are there any -force or -quiet flags or something that I can use with build-key? If not, are there are scripting or bash tricks I can use to just do this everytime? I can't find anything in any man pages about it.

share|improve this question
up vote 8 down vote accepted

If you look at the source of build-key, you'll find it's calling pkitool. I wrote a wrapper to bundle up the cilent's keys and the appropriate openvpn config files into a tarball I could then give to my users:



if [ x$client = x ]; then
    echo "Usage: $0 clientname"
    exit 1 fi

if [ ! -e keys/$client.key ]; then
    echo "Generating keys..."
    . vars
    ./pkitool $client
    echo "...keys generated." fi


if [ ! -e $tarball ]; then
    echo "Creating tarball..."
    mkdir $tmpdir
    cp company.ovpn $tmpdir/company.ovpn
    cp keys/ca.crt $tmpdir 
    cp keys/$client.key $tmpdir/client.key
    cp keys/$client.crt $tmpdir/client.crt
    tar -C $tmpdir -czvf $tarball .
    rm -rf $tmpdir
    echo "...tarball created" 
    echo "Nothing to do, so nothing done. (keys/$client.tgz already exists)" 
share|improve this answer

try --batch flag

./build-key --batch client1
share|improve this answer

The thing that comes to my mind the quickest is expect; it allows you to automate these sorts of command line interactions.

share|improve this answer
expect is way overkill for this; easy-rsa is all shell scripts, so easily hackable. – pjz Aug 23 '10 at 17:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.