Avoid password prompt for keys and prompts for DN information
Edit: This is by far my most popular answer, and it's been a few years on now so I've added an ECDSA variant. If you can use ECDSA you should.
You can supply all of that information on the command line.
One step self-signed password-less certificate generation:
RSA Version
openssl req \
-new \
-newkey rsa:4096 \
-days 365 \
-nodes \
-x509 \
-subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \
-keyout www.example.com.key \
-out www.example.com.cert
ECDSA version
openssl req \
-new \
-newkey ec \
-pkeyopt ec_paramgen_curve:prime256v1 \
-days 365 \
-nodes \
-x509 \
-subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \
-keyout www.example.com.key \
-out www.example.com.cert
All of the openssl subcommands have their own man page. See man req
.
Specifically addressing your questions and to be more explicit about exactly which options are in effect:
The
-nodes
flag signals to not encrypt the key, thus you do not need a password. You could also use the-passout arg
flag. SeePASS PHRASE ARGUMENTS
in theopenssl(1)
man page for how to format the arg.Using the
-subj
flag you can specify the subject (example is above).
Doesn't -passin
option do the trick for you?
With file:pathname
form you can be quite safe with permissions 600 for that file.
The accepted answer needs a couple of small corrections. EC Lines:
-newkey ec
-pkeyopt ec_paramgen_curve:prime256v1
should be:
-newkey ec \
-pkeyopt ec_paramgen_curve:prime256v1 \
On MacOS - OpenSSL 1.0.2f installed via brew I verified the the accepted answer as described below
To list available Elliptic curves:
$ openssl ecparam -list_curves
To generate a key file:
$ openssl ecparam -name secp256k1 -out secp256k1.pem
To generate the cert without password prompt:
openssl req \ -new \ -newkey ec:secp256k1.pem \ -days 365 \ -nodes \ -x509 \ -subj "/C=US/ST=FL/L=Ocala/O=Home/CN=example.com" \ -keyout server.key \ -out server.crt
To view the cert:
$ openssl x509 -noout -text -in server.crt