Openssl req Command

First, Introduction

The REQ directive is used to create and process certificates in the PKCS#10 format

Second, the grammar

OpenSSL  req [-inform pem| DER] [-outform pem| DER] [-infile(s)] [-newkey rsa:bits] [-newkey DSA:file] [-newkey EC:fileID ]

Options

-inform arg input Format-DER or PEM-outform arg output format-DER or PEM-inchARG inputfile-out arg outputfile-text text form of request-pubkey output Public key-noout DoNot output REQ-Verify verify signature on REQ-modulus RSA modulus-nodes Don'T encrypt the output key-engine e Use engine E, possibly a hardware device-subject Output the request's Subject-passin private key password source-keyfileUse the private key containedinch file-keyform Arg keyfileformat-keyout ArgfileTo send the key to-randfile:file:. .. load thefile(or the FilesinchThe directory) into the random number generator-newkey rsa:bits generate a new RSA key of'bits' inchsize-newkey DSA:fileGenerate a new DSA key, parameters taken from CAinch 'file'-newkey EC:fileGenerate a new EC key, parameters taken from CAinch 'file'-[digest] Digest to sign with (see OpenSSL dgst-h forlist)-configfileRequest Templatefile. -SUBJ Arg set or modify request subject-multivalue-rdn Enable support formultivalued RDNs-new new request.-batch DoNot ask anything during request generation-x509 output a x509 structure instead of a cert. req .-days Number of days a certificate generated by-x509 is valid for. -set_serial Serial number to use forA certificate generated by-X509.-NEWHDR output"NEW" inchThe header lines-asn1-kludge Output the'Request' inchA format that's wrong but some CA'sHave been reported as requiring-extensions. Specify Certificate Extension section (override valueinchConfigfile) -reqexts. Specify Request extension section (override valueinchConfigfile) -UTF8 input characters is UTF8 (default ASCII)-nameopt Arg-various certificate name options-reqopt arg-various Request Text Options

Third, examples

1. Generate a certificate request based on the private key

Mode 1

OpenSSL genrsa-des-passout Pass:"123456"1024x768-key prikey.pem-passin Pass:"123456" -new-out Cerreq.pem

Mode 2

Interactive

OpenSSL req-newkey RSA:1024x768 -keyout prikey.pem-passout Pass:"123456" -new- Out Cerreq.pem

Non-interactive

OpenSSL req-newkey RSA:1024x768 -keyout prikey.pem-passout Pass:"123456" -config Openssl.cnf-new-out Cerreq.pem

2. Generate a self-signed root certificate

OpenSSL req-x509-newkey RSA:1024x768 -keyout prikey.pem-passout Pass:"123456" - Config openssl.cnf-new-out Certself.pem

3. Generate a request with Chinese support (UTF-8)

http://blog.chinaunix.net/uid-7591044-id-1742939.html

4. Generate a request with an extension

http://bbs.csdn.net/topics/380025010

Reference: http://blog.csdn.net/as3luyuan123/article/details/16811787

Openssl req Command