To generate an SSL certificate file for Apache, I am using the below command:

 openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.cert

And I manually feed it with these parameters:

Country Name (2 letter code) [AU]:AU
State or Province Name (full name): Myname
Locality Name (eg, city) []:City
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Internet
Organizational Unit Name (eg, section) []:Section
Common Name (e.g. server FQDN or YOUR name) []:yourname
Email Address []:email@gmail.com

Is it possible to enter them from a file or right from an OpenSSL command line using options?

There is no hint from the OpenSSL man pages.


You can create a configuration file and use that in your command. You could for example create a config file named openssl.cnf and use it like this:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.cert -config ./openssl.cnf

In your case you can set the following parameters:

[ req_distinguished_name ]
# Variable name             Prompt string
#-------------------------    ----------------------------------
0.organizationName          = Organization Name (company)
organizationalUnitName          = Organizational Unit Name (department, division)
emailAddress                = Email Address
emailAddress_max            = 40
localityName                = Locality Name (city, district)
stateOrProvinceName         = State or Province Name (full name)
countryName             = Country Name (2 letter code)
countryName_min             = 2
countryName_max             = 2
commonName              = Common Name (hostname, IP, or your name)
commonName_max              = 64

More can be found at http://www.flatmtn.com/article/setting-openssl-create-certificates#SSLCert-4

  • This only sets the default values and the prompt text. The OP wants to avoid using the prompting completely. – garethTheRed Mar 9 '16 at 14:32
  • 3
    -batch Non-interactive mode – pete Mar 9 '16 at 15:37

Somewhere in your config file you need the following:

[ req ]
prompt                 = no
distinguished_name     = req_distinguished_name

[ req_distinguished_name ]
countryName             = GB
stateOrProvinceName     = Provinceshire
localityName            = Locationsville
organizationName        = Example Ltd
organizationalUnitName  = PKI
commonName              = www.example.com

The prompt = no in the [ req ] section stops the prompts you see and changes the format expected in the distinguished_name section. If you don't have this option, OpenSSL will expect the prompting format that you currently have.

Note that the order of the fields are changeable and dictate the order in the certificate.


It could also be run from a script:



 openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout
 /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.cert -subj

Found it at: http://www.jamescoyle.net/how-to/1073-bash-script-to-create-an-ssl-certificate-key-and-request-csr

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.