0

I am trying to add custom extensions to my self-signed certificate. I tried the following

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -extfile myconfig.cnf -extensions v3_req

Error is

unknown option -extfile

myconfig.cnf

[req]
req_extensions = v3_req

[v3_req]
1.2.3.4.5.6.7.8=ASN1:UTF8String:Something

when I remove -extfile myconfig.cnf -extensions v3_req, I see cert.pem created successfully.

I do see -extfile is not a valid option. However, I see other posts suggesting the same Openssl Custom Extension

EDIT

I used -config instead of -extfile but I get the following error

unable to find 'distinguished_name' in config
problems making Certificate Request
4646921836:error:0EFFF06C:configuration file routines:CRYPTO_internal:no value:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.260.1/libressl-2.6/crypto/conf/conf_lib.c:322:group=req name=distinguished_name
1
  • The other Q you link is about the openssl ca subcommand, not the req subcommand. These are different, althouth they both use the same syntax in the config file/section once that is determined. Feb 29, 2020 at 6:05

2 Answers 2

3

Your configuration file contains two small errors:

  1. When called with -x509 req does not look for the req_extensions, but the x509_extensions section,
  2. Your configuration file does not contain a distinguished name attribute, which is the only certificate attribute without a default value.

Therefore a minimal configuration file would look like this:

[ req ]
distinguished_name = dn
x509_extensions = extensions
prompt = no

[ extensions ]
1.2.3.4 = ASN1:UTF8String:Something

[ dn ]
0.DC = com
1.DC = example
commonName = example.com

The prompt option disables prompting for the distinguished name RDNs. You can generate your certificate with:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem\
-days 365 -config myconfig.cnf

A more complete example should, of course, include some standard extensions in the [ extensions ] section, which you can find in the standard OpenSSL config:

# PKIX recommendation.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = critical,CA:true
0

You need to use -config option to specify the configuration, instead of -extfile. In your case, this file should have a [v3_req] section.

For details see openssl req man page.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .