OPENSSL-CA(1ssl) OpenSSL OPENSSL-CA(1ssl) (NAME) openssl-ca - (CA) (SYNOPSIS) openssl ca [-help] [-verbose] [-quiet] [-config filename] [-name section] [-section section] [-gencrl] [-revoke file] [-valid file] [-status serial] [-updatedb] [-crl_reason reason] [-crl_hold instruction] [-crl_compromise time] [-crl_CA_compromise time] [-crl_lastupdate date] [-crl_nextupdate date] [-crldays days] [-crlhours hours] [-crlsec seconds] [-crlexts section] [-startdate date] [-not_before date] [-enddate date] [-not_after date] [-days arg] [-md arg] [-policy arg] [-keyfile filename|uri] [-keyform DER|PEM|P12|ENGINE] [-key arg] [-passin arg] [-cert file] [-certform DER|PEM|P12] [-selfsign] [-in file] [-inform DER|] [-out file] [-notext] [-dateopt] [-outdir dir] [-infiles] [-spkac file] [-ss_cert file] [-preserveDN] [-noemailDN] [-batch] [-msie_hack] [-extensions section] [-extfile section] [-subj arg] [-utf8] [-sigopt nm:v] [-vfyopt nm:v] [-create_serial] [-rand_serial] [-multivalue-rdn] [-rand files] [-writerand file] [-engine id] [-provider name] [-provider-path path] [-provparam [name:]key=value] [-propquery propq] [certreq...] (DESCRIPTION) (CA) . WARNINGS . X.509 . x509v3_config(5) . (CSR) (CRL) . . -in certreq . : req x509 . openssl-req(1) openssl-x509(1) . ca . (OPTIONS) -help . -verbose . -quiet (batch) (pipelines) . -config filename . "COMMAND SUMMARY" openssl(1) . -name section, -section section ( default_ca ca ). -in filename (CSR) CA. -inform DER|PEM (CSR) PEM . openssl-format-options(1) . -ss_cert filename CA. -spkac filename (challenge) CA. SPKAC FORMAT . -infiles . -out filename . . PEM ( -spkac DER ). -outdir directory / . () .pem . -cert filename CA -keyfile . -certform DER|PEM|P12 . openssl-format-options(1) . -keyfile filename|uri CA . -cert . -keyform DER|PEM|P12|ENGINE . openssl-format-options(1) . -sigopt nm:v . "Signature parameters" provider-signature(7) . -vfyopt nm:v (verify). . (CSR) . -key password . ( ps(1) ) . -passin . -passin arg PKCS#12 . arg openssl-passphrase-options(1) . -selfsign ( -keyfile). . -spkac -ss_cert -gencrl -selfsign . -selfsign ( database ) . -notext . -dateopt . : rfc_822 iso_8601. rfc_822 . -startdate date, -not_before date . YYMMDDHHMMSSZ ( ASN1 UTCTime) YYYYMMDDHHMMSSZ ( ASN1 GeneralizedTime) . SS Z . "today" . -enddate date, -not_after date . YYMMDDHHMMSSZ ( ASN1 UTCTime) YYYYMMDDHHMMSSZ ( ASN1 GeneralizedTime) . SS Z . "today" . -days . -days arg . -not_before . -not_after/-startdate . -md alg (Digest) . (digest) openssl-dgst(1) . ( Ed25519 Ed448) . CRL . -policy arg <<>> (policy) CA . CA . POLICY FORMAT . -msie_hack (IE) "certenr3" . UniversalString . . -preserveDN (DN) (policy) . . IE DN . Xenroll . -noemailDN (DN) EMAIL DN (e-mail) altName . EMAIL (Subject) ( ) . email_in_dn . -batch (batch mode) . . -extensions section (certificate extensions) ( x509_extensions -extfile ). x509v3_config(5) . -extfile file ( -extensions ). -subj arg (Subject) . "/type0=value0/type1=value1/type2=..." . "\" () . . "/" RDN ( NULL-DN) . RDN "+" "/" AttributeValueAssertion (AVA) . : "/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe" -utf8 UTF8 ASCII . UTF8 . -create_serial . -rand_serial . -rand_serial . . -multivalue-rdn . -rand files, -writerand file "Random State Options" openssl(1) . -engine id "Engine Options" openssl(1) . . -provider name -provider-path path -provparam [name:]key=value -propquery propq "Provider Options" openssl(1) provider(7) property(7) . (CRL OPTIONS) -gencrl (CRL) . -crl_lastupdate time lastUpdate CRL . YYMMDDHHMMSSZ ( ASN1 UTCTime) YYYYMMDDHHMMSSZ ( ASN1 GeneralizedTime) . -crl_nextupdate time nextUpdate CRL -crldays -crlhours -crlsec . -crl_lastupdate . -crldays num CRL . nextUpdate CRL. -crlhours num CRL . -crlsec num CRL . -revoke filename . -valid filename (Valid). -status serial . -updatedb . -crl_reason reason reason : unspecified keyCompromise CACompromise affiliationChanged superseded cessationOfOperation certificateHold removeFromCRL. reason . CRL (v2) . removeFromCRL CRL (delta CRL) . -crl_hold instruction CRL certificateHold (hold instruction) instruction (OID) . OID holdInstructionNone ( RFC 5280 ) holdInstructionCallIssuer holdInstructionReject . -crl_compromise time keyCompromise / time . time GeneralizedTime YYYYMMDDHHMMSSZ . -crl_CA_compromise time crl_compromise CACompromise . -crlexts section CRL . CRL CRL (V1) CRL ( ) CRL (V2) . CRL CRL CRL. ( Netscape) CRL V2 . x509v3_config(5) . (CONFIGURATION FILE OPTIONS) : -name . default_ca ca ( ) . default_ca ca : RANDFILE preserve msie_hack RANDFILE . . . ( ) . oid_file OBJECT IDENTIFIERS ( ) . . oid_section . = . . new_certs_dir -outdir . . . certificate -cert . CA . . private_key -keyfile . CA . . RANDFILE . (: RANDFILE "HISTORY" ). default_days -days . . default_startdate -startdate . . . default_enddate -enddate . default_days ( ) . default_crl_hours default_crl_days -crlhours -crldays . . CRL . default_md -md . (digest) ( Ed25519 Ed448). database . . . unique_subject yes (unique subject) . no . OpenSSL ( 0.9.8) yes . / (roll-over) CA no -selfsign . . . serial (hex). . . crlnumber CRL (hex). CRL CRL . CRL . x509_extensions -extensions. crl_extensions -crlexts. preserve -preserveDN . email_in_dn -noemailDN . EMAIL DN 'no' . EMAIL DN . msie_hack -msie_hack . policy -policy . . POLICY FORMAT . name_opt, cert_opt . -nameopt -certopt x509 no_signame no_sigdump ( ). ca_default . OpenSSL . policy . copy_extensions . none . copy . copyall : . WARNINGS . subjectAltName . (POLICY FORMAT) DN . "match" CA . "supplied" . "optional" . -preserveDN . SPKAC (SPKAC FORMAT) -spkac (SPKAC) . KEYGEN HTML . SPKAC openssl-spkac(1) . SPKAC SPKAC DN . '.' . SPKAC -out DER (stdout) -outdir PEM . (EXAMPLES) : . CA openssl-req(1) . demoCA demoCA/private demoCA/newcerts . CA demoCA/cacert.pem demoCA/private/cakey.pem . demoCA/serial "01" demoCA/index.txt . : openssl ca -in req.pem -out newcert.pem SM2: openssl ca -in sm2.csr -out sm2.crt -md sm3 \ -sigopt "distid:1234567812345678" \ -vfyopt "distid:1234567812345678" CA: openssl ca -in req.pem -extensions v3_ca -out newcert.pem (CRL): openssl ca -gencrl -out crl.pem : openssl ca -infiles req1.pem req2.pem req3.pem SPKAC : openssl ca -spkac spkac.txt SPKAC ( SPKAC ): SPKAC=MIG0MGAwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAn7PDhCeV/xIxUg8V70YRxK2A5 CN=Steve Test emailAddress=steve@openssl.org 0.OU=OpenSSL Group 1.OU=Another Group : [ ca ] default_ca = CA_default # The default ca section [ CA_default ] dir = ./demoCA # top dir database = $dir/index.txt # index file. new_certs_dir = $dir/newcerts # new certs dir certificate = $dir/cacert.pem # The CA cert serial = $dir/serial # serial no file #rand_serial = yes # for random serial#'s private_key = $dir/private/cakey.pem# CA private key default_days = 365 # how long to certify for default_crl_days= 30 # how long before next CRL default_md = sha256 # md to use policy = policy_any # default policy email_in_dn = no # Don't add the email into cert DN name_opt = ca_default # Subject name display option cert_opt = ca_default # Certificate display option copy_extensions = none # Don't copy extensions from request [ policy_any ] countryName = supplied stateOrProvinceName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional (FILES) : . . /usr/local/ssl/lib/openssl.cnf - ./demoCA - CA ./demoCA/cacert.pem - CA ./demoCA/private/cakey.pem - CA ./demoCA/serial - CA ./demoCA/serial.old - CA ./demoCA/index.txt - CA ./demoCA/index.txt.old - CA ./demoCA/certs - (RESTRICTIONS) . CRL . V2 CRL CRL (delta CRLs) . SPKAC (self-signed) . (BUGS) . (in-memory) . . CA.pl . (policy) . -preserveDN . EMAIL DN RFC -noemailDN . . . (WARNINGS) CA . . CA . () . HSM engine . : openssl ca . copy_extensions . . basicConstraints CA:TRUE copy_extensions copyall CA . copy_extensions copy basicConstraints CA:FALSE . basicConstraints . keyUsage . CA . CA : basicConstraints = CA:TRUE, pathlen:0 CA:TRUE . (HISTORY) 1.1.1 RFC5280 . ( -startdate -enddate -days) / CRL ( -crl_lastupdate -crl_nextupdate -crldays -crlhours -crlsec) ( ) UTCTime GeneralizedTime . 1.1.1 (CSPRNG) . RANDFILE . . -section 3.0.0 . -multivalue-rdn 3.0.0 . -engine 3.0 . 3.2 X.509 . (SEE ALSO) openssl(1), openssl-req(1), openssl-spkac(1), openssl-x509(1), CA.pl(1), config(5), x509v3_config(5) (COPYRIGHT) - OpenSSL. . . (<<>>) . . LICENSE : . 3.6.4 2026-08-25 OPENSSL-CA(1ssl)