OPENSSL-REQ(1ssl) OpenSSL OPENSSL-REQ(1ssl) (NAME) openssl-req - PKCS#10 (SYNOPSIS) openssl req [-help] [-cipher] [-inform DER|PEM] [-outform DER|PEM] [-in filename] [-passin arg] [-out filename] [-passout arg] [-text] [-pubkey] [-noout] [-verify] [-modulus] [-new] [-newkey arg] [-pkeyopt opt:value] [-noenc] [-nodes] [-key filename|uri] [-keyform DER|PEM|P12|ENGINE] [-keyout filename] [-keygen_engine id] [-digest] [-config filename] [-section name] [-x509] [-x509v1] [-CA filename|uri] [-CAkey filename|uri] [-not_before date] [-not_after date] [-days n] [-set_serial n] [-newhdr] [-copy_extensions arg] [-extensions section] [-reqexts section] [-addext ext] [-precert] [-utf8] [-reqopt] [-subject] [-subj arg] [-multivalue-rdn] [-sigopt nm:v] [-vfyopt nm:v] [-batch] [-verbose] [-quiet] [-nameopt option] [-rand files] [-writerand file] [-engine id] [-provider name] [-provider-path path] [-provparam [name:]key=value] [-propquery propq] (DESCRIPTION) (CSR) PKCS#10 . CA (Root CA) . (OPTIONS) -help . -inform DER|PEM CSR PEM . openssl-format-options(1) . -outform DER|PEM . openssl-format-options(1) . PKCS#10 . -cipher name . AES-256-CBC . OpenSSL . -in filename . -x509 -CA . (-new -newkey -precert) . -sigopt nm:v . . -vfyopt nm:v . . -passin arg . arg openssl-passphrase-options(1) . -passout arg . arg openssl-passphrase-options(1) . -out filename . -text . -subject (subject) ( -x509 ). -pubkey . -noout . -modulus . -verify . ( -text) . -new . . . -key -newkey -pkeyopt RSA . -newkey arg -key . -key . -new -x509 . . [rsa:]nbits RSA nbits . nbits -newkey rsa default_bits . -newkey algname:file file "openssl genpkey -genparam" X.509 . param:file file . algname[:file] algname . file algname . -pkeyopt . dsa:filename filename DSA . ec:filename EC ( ECDSA ECDH) gost2001:filename GOST R 34.10-2001 ( gost ). gost2001 -pkeyopt paramset:X . -pkeyopt opt:value opt value . . "KEY GENERATION OPTIONS" openssl-genpkey(1) . -key filename|uri . -in . -CA . PKCS#8 PEM . -keyform DER|PEM|P12|ENGINE . openssl-format-options(1) . -keyout filename -key . -keyout -key default_keyfile . -key -keyout . . -noenc . -nodes OpenSSL 3.0 -noenc . -digest (digest) . dgst OpenSSL . . . DSA SHA1 GOST R 34.10 GOST R 34.11-94 (-md_gost94) Ed25519 Ed448 . -config filename . "COMMAND SUMMARY" openssl(1) . -section name req . -subj arg (subject) . "/type0=value0/type1=value1/type2=..." . "\" () . . "/" RDN ( NULL-DN) . RDN "+" "/" AttributeValueAssertion (AVAs) . : "/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe" -multivalue-rdn . -x509 . . -CA . -in -new . -in . -set_serial . -copy_extensions X.509 . X.509 ( -config -extensions) / -addext . -x509v1 X.509 . x509v3_config(5) . -x509v1 X.509 . -x509 . X.509 X.509 . -CA filename|uri "CA" -x509 . "micro CA" : "CA" "CA" . -CAkey filename|uri "CA" . -CA . -CA . -not_before date -x509 . date YYMMDDHHMMSSZ ( ASN1 UTCTime) YYYYMMDDHHMMSSZ ( ASN1 GeneralizedTime) . SS Z . "today" . -not_after date -x509 . date YYMMDDHHMMSSZ ( ASN1 UTCTime) YYYYMMDDHHMMSSZ ( ASN1 GeneralizedTime) . SS Z . "today" . -days . -days n -x509 . n . . -not_before . -not_after . -set_serial n . "0x" . . -copy_extensions arg X.509 -x509 . arg none . arg copy copyall . subjectAltName . -extensions section, -reqexts section X.509 ( -x509) . . -addext ext ( -x509 ) . "key=value" . OID . . . -precert (poison extension) "" (pre-certificate RFC6962 ) . (Certificate Transparency) (SCTs) . SCT . -new . -utf8 UTF8 ASCII . UTF8 . -reqopt option -text . option . -certopt openssl-x509(1) . -newhdr NEW (header) (footer) PEM . ( ) CA . -batch . -verbose . -quiet ( << >> ). -keygen_engine id ( id ) . -nameopt option . openssl-namedisplay-options(1) . -rand files, -writerand file "Random State Options" openssl(1) . -engine id "Engine Options" openssl(1) . . -provider name -provider-path path -provparam [name:]key=value -propquery propq "Provider Options" openssl(1) provider(7) property(7) . (CONFIGURATION FILE FORMAT) req . -section . default . . input_password, output_password ( ) ( ). passin passout . default_bits . -new . -newkey . . . default_keyfile . . -keyout . oid_file (OBJECT IDENTIFIERS) . . oid_section . = . . RANDFILE . . encrypt_key no . -noenc . encrypt_rsa_key . default_md . dgst OpenSSL . . ( Ed25519 Ed448) . string_mask () . . : utf8only - UTF8String ( ) pkix - T61String nombstr - BMPString UTF8String default - utf8only PKIX RFC 5280 string_mask default . nombstr BMPString UTF8String . req_extensions . -reqexts ( -extensions) . x509v3_config(5) . x509_extensions -x509 . -extensions . prompt no . distinguished_name attributes . utf8 yes UTF8 ASCII . UTF8 . attributes : distinguished_name . challengePassword unstructuredName . OpenSSL CA . distinguished_name (DN) . . (DISTINGUISHED NAME AND ATTRIBUTE SECTION FORMAT) (DN) . prompt no : CN=My Name OU=My Organization emailAddress=someone@somewhere.org ( ) . (EXAMPLES) . prompt no . : fieldName="prompt" fieldName_default="default field value" fieldName_min= 2 fieldName_max= 4 "fieldName" commonName ( CN). "prompt" . . '.' . fieldName_min fieldName_max : ( countryName PrintableString ). ( organizationName) DN . . fieldName . organizationName "1.organizationName" . (OID) . OpenSSL commonName countryName localityName organizationName organizationalUnitName stateOrProvinceName . emailAddress name surname givenName initials dnQualifier . oid_file oid_section . DirectoryString . (EXAMPLES) : openssl req -in req.pem -text -verify -noout : openssl req -newkey rsa:2048 -keyout privatekey.pem -out request.csr -cipher aes-256-cbc : openssl genrsa -out key.pem 2048 openssl req -new -key key.pem -out req.pem req: openssl req -newkey rsa:2048 -keyout key.pem -out req.pem : openssl req -x509 -newkey rsa:2048 -keyout key.pem -out req.pem SM2 : openssl ecparam -genkey -name SM2 -out sm2.key openssl req -new -key sm2.key -out sm2.csr -sm3 -sigopt "distid:1234567812345678" SM2: openssl req -verify -in sm2.csr -sm3 -vfyopt "distid:1234567812345678" oid_file : 1.2.3.4 shortName A longer Name 1.2.3.6 otherName Other longer Name oid_section : testoid1=1.2.3.5 testoid2=${testoid1}.6 : [ req ] default_bits = 2048 default_keyfile = privkey.pem distinguished_name = req_distinguished_name attributes = req_attributes req_extensions = v3_ca dirstring_type = nombstr [ req_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = AU countryName_min = 2 countryName_max = 2 localityName = Locality Name (eg, city) organizationalUnitName = Organizational Unit Name (eg, section) commonName = Common Name (eg, YOUR name) commonName_max = 64 emailAddress = Email Address emailAddress_max = 40 [ req_attributes ] challengePassword = A challenge password challengePassword_min = 4 challengePassword_max = 20 [ v3_ca ] subjectKeyIdentifier=hash authorityKeyIdentifier=keyid:always,issuer:always basicConstraints = critical, CA:true : [ req ] default_bits = 2048 default_keyfile = keyfile.pem distinguished_name = req_distinguished_name attributes = req_attributes prompt = no output_password = mypass [ req_distinguished_name ] C = GB ST = Test State or Province L = Test Locality O = Organization Name OU = Organizational Unit Name CN = Common Name emailAddress = test@email.address [ req_attributes ] challengePassword = A challenge password ( ) : openssl req -new -subj "/C=GB/CN=foo" \ -addext "subjectAltName = DNS:foo.co.uk" \ -addext "certificatePolicies = 1.2.3.4" \ -newkey rsa:2048 -keyout key.pem -out req.pem (NOTES) Xenroll MSIE . keyUsage ( ) OID extendedKeyUsage . (DIAGNOSTICS) : Using configuration from /some/path/openssl.cnf Unable to load config info : unable to find 'distinguished_name' in config problems making Certificate Request : ! ( ) . . . : Attributes: a0:00 SET OF ( DER 0xa0 0x00 ). : Attributes: SET OF ( ). -asn1-kludge . (BUGS) T61String ( TeletexString) OpenSSL : ISO-8859-1 (Latin 1) Netscape MSIE . PrintableString BMPString . T61String OpenSSL BMPString : Netscape . Netscape MSIE T61String . . . . subjectAltName . (SEE ALSO) openssl(1), openssl-x509(1), openssl-ca(1), openssl-genrsa(1), openssl-gendsa(1), config(5), x509v3_config(5) (HISTORY) 3DES AES-256 OpenSSL 3.5 . -section OpenSSL 3.0.0 . -multivalue-rdn OpenSSL 3.0.0 . -engine OpenSSL 3.0 . -nodes OpenSSL 3.0 -noenc . -reqexts OpenSSL 3.2 -extensions . OpenSSL 3.2 X.509 -x509v1 . OpenSSL 3.3 -verify . (COPYRIGHT) - OpenSSL . . . ("") . . LICENSE : . 3.6.4 2026-08-25 OPENSSL-REQ(1ssl)