OPENSSL-REQ(1ssl) OpenSSL OPENSSL-REQ(1ssl) openssl-req - PKCS#10 openssl req [-help] [-cipher] [-inform DER|PEM] [-outform DER|PEM] [-in _] [-passin ] [-out _] [-passout ] [-text] [-pubkey] [-noout] [-verify] [-modulus] [-new] [-newkey ] [-pkeyopt :] [-noenc] [-nodes] [-key _|uri] [-keyform DER|PEM|P12|ENGINE] [-keyout _] [-keygen_engine ] [-] [-config _] [-section ] [-x509] [-x509v1] [-CA _|uri] [-CAkey _|uri] [-not_before ] [-not_after ] [-days n] [-set_serial n] [-newhdr] [-copy_extensions ] [-extensions ] [-reqexts ] [-addext ext] [-precert] [-utf8] [-reqopt] [-subject] [-subj ] [-multivalue-rdn] [-sigopt nm:v] [-vfyopt nm:v] [-batch] [-verbose] [-quiet] [-nameopt ] [-rand ] [-writerand ] [-engine ] [-provider ] [-provider-path ] [-provparam [:]=] [-propquery propq] (CSRs) PKCS#10. (CAs) . -help . -inform DER|PEM (CSR) PEM . openssl-format-options(1) . -outform DER|PEM . openssl-format-options(1) . PKCS#10. -cipher . AES-256-CBC . OpenSSL. -in _ . -x509 -CA. (-new -newkey -precert). -sigopt : . . -vfyopt : . . -passin . arg openssl-passphrase-options(1). -passout . arg openssl-passphrase-options(1). -out _ . -text . -subject ( -x509). -pubkey . -noout . -modulus (modulus) . -verify . ( -text). -new . . . -key -newkey -pkeyopt RSA 2048 . -newkey -key. -key. -new -x509. . [rsa:]nbits RSA nbits. nbits -newkey rsa default_bits 2048. -newkey _: "openssl genpkey -genparam" X.509 . param: . _[:] _. _. -pkeyopt. dsa:_ DSA _. ec:_ EC ( ECDSA ECDH) gost2001:_ GOST R 34.10-2001 ( gost ). gost2001 -pkeyopt paramset:X -pkeyopt : opt value. . "KEY GENERATION OPTIONS" openssl-genpkey(1) . -key _|uri . -in . -CA. PKCS#8 PEM. -keyform DER|PEM|P12|ENGINE . openssl-format-options(1) . -keyout _ -key. -keyout -key default_keyfile . -key -keyout . . -noenc . -nodes OpenSSL 3.0 -noenc . - (digest) . OpenSSL dgst. . . DSA SHA1 GOST R 34.10 GOST R 34.11-94 (-md_gost94) Ed25519 Ed448 . -config _ . "COMMAND SUMMARY" openssl(1). -section req. -subj . "/type0=value0/type1=value1/type2=...". "\" ( ) . . "/" RDNs (NULL-DN). RDNs "+" "/" (AVAs) . : "/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe" -multivalue-rdn . -x509 . . -CA. -new -in. -in . -set_serial . -copy_extensions X.509 . X.509 -config -extensions / -addext. -x509v1 3 X.509. x509v3_config(5). -x509v1 1 X.509. -x509. X.509 3 X.509 . -CA _|uri "CA" ( ) -x509. " " : "CA" "CA" . -CAkey _|uri "CA" . -CA. -CA. -not_before -x509 . YYMMDDHHMMSSZ ( ASN1 UTCTime) YYYYMMDDHHMMSSZ ( ASN1 GeneralizedTime). SS Z. "today". -not_after -x509 . YYMMDDHHMMSSZ ( ASN1 UTCTime) YYYYMMDDHHMMSSZ ( ASN1 GeneralizedTime). SS Z. "today". -days. -days n -x509 . n . 30 . -not_before . -not_after . -set_serial n . "0x". . -copy_extensions X.509 -x509. none . copy copyall . subjectAltName. -extensions -reqexts X.509 ( -x509) . . -addext ( -x509 ) . "key=value" . OID . . . -precert (poison extension) " " ( RFC6962). (SCTs). SCTs . -new. -utf8 UTF8 ASCII. UTF8 . -reqopt -text. . -certopt openssl-x509(1). -newhdr NEW PEM . ( ) . -batch . -verbose . -quiet ( " " ). -keygen_engine ( ) . -nameopt . openssl-namedisplay-options(1) . -rand -writerand " " openssl(1) . -engine id " " openssl(1). . -provider -provider-path -provparam [:]= -propquery _ " " openssl(1) provider(7) property(7). req . -section. (default) . . input_password output_password ( ) ( ). passin passout . default_bits . -new . -newkey. 512 . 2048 . default_keyfile . . -keyout. oid_file . . oid_section . = . . RANDFILE 256 . . encrypt_key no . -noenc. encrypt_rsa_key . default_md (digest) . dgst OpenSSL. . ( Ed25519 Ed448) . string_mask . . : utf8only - UTF8Strings ( ) pkix - T61Strings nombstr - BMPStrings UTF8Strings default - utf8only PKIX RFC 5280 string_mask default . nombstr BMPStrings UTF8Strings . req_extensions . -reqexts ( -extensions). x509v3_config(5) . x509_extensions -x509. -extensions. prompt no . distinguished_name attributes. utf8 yes UTF8 ASCII. UTF8 . attributes : distinguished_name. challengePassword unstructuredName. OpenSSL (CAs). distinguished_name (DN) . . . prompt no : CN= OU= emailAddress=someone@somewhere.org ( ) . EXAMPLES. prompt no . : fieldName="_" fieldName_default="__" fieldName_min= 2 fieldName_max= 4 "fieldName" commonName ( CN). "prompt" . . '.' . fieldName_min fieldName_max: ( countryName PrintableString). ( organizationName) (DN). . fieldName . organizationName "1.organizationName". . OpenSSL commonName countryName localityName organizationName organizationalUnitName stateOrProvinceName. emailAddress name surname givenName initials dnQualifier. oid_file oid_section . DirectoryString. : openssl req -in req.pem -text -verify -noout : openssl req -newkey rsa:2048 -keyout privatekey.pem -out request.csr -cipher aes-256-cbc : openssl genrsa -out key.pem 2048 openssl req -new -key key.pem -out req.pem req : openssl req -newkey rsa:2048 -keyout key.pem -out req.pem : openssl req -x509 -newkey rsa:2048 -keyout key.pem -out req.pem SM2 : openssl ecparam -genkey -name SM2 -out sm2.key openssl req -new -key sm2.key -out sm2.csr -sm3 -sigopt "distid:1234567812345678" SM2 : openssl req -verify -in sm2.csr -sm3 -vfyopt "distid:1234567812345678" oid_file: 1.2.3.4 _ 1.2.3.6 _ oid_section : testoid1=1.2.3.5 testoid2=${testoid1}.6 : [ req ] default_bits = 2048 default_keyfile = privkey.pem distinguished_name = req_distinguished_name attributes = req_attributes req_extensions = v3_ca dirstring_type = nombstr [ req_distinguished_name ] countryName = ( ) countryName_default = AU countryName_min = 2 countryName_max = 2 localityName = ( ) organizationalUnitName = ( ) commonName = ( ) commonName_max = 64 emailAddress = emailAddress_max = 40 [ req_attributes ] challengePassword = challengePassword_min = 4 challengePassword_max = 20 [ v3_ca ] subjectKeyIdentifier=hash authorityKeyIdentifier=keyid:always,issuer:always basicConstraints = critical, CA:true : [ req ] default_bits = 2048 default_keyfile = keyfile.pem distinguished_name = req_distinguished_name attributes = req_attributes prompt = no output_password = mypass [ req_distinguished_name ] C = GB ST = L = O = OU = CN = emailAddress = test@email.address [ req_attributes ] challengePassword = ( ) : openssl req -new -subj "/C=GB/CN=foo" \ -addext "subjectAltName = DNS:foo.co.uk" \ -addext "certificatePolicies = 1.2.3.4" \ -newkey rsa:2048 -keyout key.pem -out req.pem Xenroll MSIE. keyUsage ( ) (OIDs) extendedKeyUsage. : Using configuration from /some/path/openssl.cnf Unable to load config info : unable to find 'distinguished_name' in config problems making Certificate Request : ! ( ) . . . : Attributes: a0:00 SET OF ( DER 0xa0 0x00). : Attributes: SET OF ( ). -asn1-kludge . OpenSSL T61Strings ( TeletexStrings) : ISO-8859-1 (Latin 1) Netscape MSIE . PrintableStrings BMPStrings. T61String () OpenSSL BMPString: Netscape . Netscape MSIE T61String . . . . : subjectAltName . openssl(1), openssl-x509(1), openssl-ca(1), openssl-genrsa(1), openssl-gendsa(1), config(5), x509v3_config(5) 3DES AES-256 OpenSSL 3.5. -section OpenSSL 3.0.0. -multivalue-rdn OpenSSL 3.0.0 . -engine 3.0 OpenSSL. <-nodes> 3.0 OpenSSL -noenc . -reqexts -extensions OpenSSL 3.2. OpenSSL 3.2 3 X.509 -x509v1 . 3.3 OpenSSL -verify 1 . 2000-2025 OpenSSL. . Apache 2.0 ( ""). . LICENSE . 3 . . : . 3.6.2 7 2026 OPENSSL-REQ(1ssl)