Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using openssl on Mac OS X 10.9 to generate a self-signed certificate for Windows Server Remote Desktop Services.

Using the command below I can generate the certificate,

   openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout myserver.key -out myserver.crt

However, I need to add an extended key usage string Server Authentication ( and I can't figure out how to do it in the command above.

I have tried using the openssl option -extfile with a file containing this,

[= default ]
extendedKeyUsage =

However, I get an error that "-extfile option is not found"

share|improve this question
(CLI) openssl config files convinced me it was easier to write code to generate the certificates I wanted. I used golang, but I guess you could use the openssl clib. –  Rhythmic Fistman Feb 4 at 4:55

1 Answer 1

up vote 0 down vote accepted

While openssl x509 uses -extfile, the command you are using, openssl req, needs -config to specify the configuration file.

So, you might use a command like this:

openssl req -x509 -config cert_config -extensions 'my server exts' -nodes \
            -days 365 -newkey rsa:4096 -keyout myserver.key -out myserver.crt

The usual prompts for the distinguished name bits are defined in the default configuration file (which is probably /System/Library/OpenSSL/openssl.cnf on OS X), but this file is not processed when you use -config, so your configuration file must also include some DN bits. Thus, the above-referenced cert_config might look something like this:

[ req ]
prompt             = no
distinguished_name = my dn

[ my dn ]
# The bare minimum is probably a commonName
            commonName = secure.example.com
           countryName = XX
          localityName = Fun Land
      organizationName = MyCo LLC LTD INC (d.b.a. OurCo)
organizationalUnitName = SSL Dept.
   stateOrProvinceName = YY
          emailAddress = ssl-admin@example.com
                  name = John Doe
               surname = Doe
             givenName = John
              initials = JXD
           dnQualifier = some

[ my server exts ]
extendedKeyUsage =
# can also be spelled serverAuth:
# extendedKeyUsage = serverAuth

# see x509v3_config for other extensions

As indicated in the comment, you can probably leave out most of the DN fields. For HTTPS usage, I think all you need is a CN that matches your hostname.

The Distinguished Name and Attribute Section Format section of req(1) shows how you could modify the above configuration to prompt for values (and provide default values) if you wanted to generate multiple similar certificates/requests.

If you need other certificate extensions, check x509v3_config(5) for what other bits you can specify in extension sections.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.