Avoid password prompt for keys and prompts for DN information

Edit: This is by far my most popular answer, and it's been a few years on now so I've added an ECDSA variant. If you can use ECDSA you should.


You can supply all of that information on the command line.

One step self-signed password-less certificate generation:

RSA Version

openssl req \
    -new \
    -newkey rsa:4096 \
    -days 365 \
    -nodes \
    -x509 \
    -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \
    -keyout www.example.com.key \
    -out www.example.com.cert

ECDSA version

openssl req \
    -new \
    -newkey ec \
    -pkeyopt ec_paramgen_curve:prime256v1 \
    -days 365 \
    -nodes \
    -x509 \
    -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \
    -keyout www.example.com.key \
    -out www.example.com.cert

All of the openssl subcommands have their own man page. See man req.


Specifically addressing your questions and to be more explicit about exactly which options are in effect:

  1. The -nodes flag signals to not encrypt the key, thus you do not need a password. You could also use the -passout arg flag. See PASS PHRASE ARGUMENTS in the openssl(1) man page for how to format the arg.

  2. Using the -subj flag you can specify the subject (example is above).


Doesn't -passin option do the trick for you?

With file:pathname form you can be quite safe with permissions 600 for that file.


The accepted answer needs a couple of small corrections. EC Lines:

-newkey ec
-pkeyopt ec_paramgen_curve:prime256v1

should be:

 -newkey ec \
 -pkeyopt ec_paramgen_curve:prime256v1 \

On MacOS - OpenSSL 1.0.2f installed via brew I verified the the accepted answer as described below

  • To list available Elliptic curves:

    $ openssl ecparam -list_curves
    
  • To generate a key file:

    $ openssl ecparam -name secp256k1 -out secp256k1.pem
    
  • To generate the cert without password prompt:

    openssl req \
        -new \
        -newkey ec:secp256k1.pem \
        -days 365 \
        -nodes \
        -x509 \
        -subj "/C=US/ST=FL/L=Ocala/O=Home/CN=example.com" \
        -keyout server.key \
        -out server.crt
    
  • To view the cert:

    $ openssl x509 -noout -text -in server.crt