3

I run this command to generate a CSR and a new key with openssl:

openssl req -new -nodes -days 9000 -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/mycompany.com.csr -keyout /etc/ssl/private/mycompany.com.key

I can't figure out what command I can run to generate just the key and not the CSR?

Improve this question
5
  • Check the man page for openssl. req is PKCS#10 X.509 Certificate Signing Request (CSR) Management. That means that you can't use req to work with something other than CSRs. Depending on what you really want to do, commands like passwd, pkey or rand may fit the bill better. Commented Jul 19, 2013 at 18:07
  • Thanks, what I want to know is what will produce the exact same kind of key as the req above. I think it is something like openssl genrsa -out /etc/ssl/private/mycompany.com.key 2048, just not sure? Commented Jul 19, 2013 at 18:10
  • @Michael sorry, I should point out that the req in the question does produce a key because of the -keyout - that might have not been clear enough in the question. Commented Jul 19, 2013 at 18:17
  • Thanks for the post. I found many usefull commands to generate csr, key and self-signed crt on the fly with one command in non-interactive mode. Here is the link - sysadm.pp.ua/internet/pound-apache-nginx-ssl-setup.html ,maybe if would be usefull Commented Jan 13, 2015 at 20:29
  • @aprogrammer - thanks for the link, the commands on that page are useful, but the rest of the page is in Russian. Here's the Google translated URL for that page: translate.google.com/…. Commented Jan 13, 2015 at 22:48

1 Answer 1

Reset to default
3

Yes the genrsa switch is the key that's getting generated in the req command. To generate the key I believe you just need to run this command:

$ openssl genrsa -out clientkey.pem

I always reference this page titled: The Most Common OpenSSL Commands - SSL Shopper. You can see from the examples that the key for a CSR is RSA, you can even control it's length when using the req command through the rsa:2048 parameter.

Examples:

  • Generate a new private key and Certificate Signing Request

    $ openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key

  • Generate a certificate signing request (CSR) for an existing private key

    $ openssl req -out CSR.csr -key privateKey.key -new

In the above you'll notice the use of the privateKey.key from the previous step being used to create the CSR.

References

Improve this answer
2
  • Thanks, just what I wanted to know. I had found that page and noticed that it didn't have a command to generate a standalone key, which I think is a bit odd, don't you? Commented Jul 19, 2013 at 20:07
  • @JackDouglas - yes I usually use that page plus several others to "refresh" my memories on how openssl works 8-). I've been meaning to write them up on my blog, when I can find the time. Commented Jul 19, 2013 at 20:11

You must log in to answer this question.