9

I am using the following command in order to generate a CSR together with a private key by using OpenSSL:

openssl req -new -subj "/CN=sample.myhost.com" -out newcsr.csr -nodes -sha512 -newkey rsa:2048

It generates two files:

  • newcsr.csr
  • privkey.pem

The generated private key has no password: how can I add one during the generation process?

Note: take into account that my final goal is to generate a p12 file by combining the certificate provided according to the CSR and the private key (secured with a password).

18

Ditch "-nodes"

Just leave out the (awkwardly named) -nodes (read: "No DES encryption") parameter from the command.

Use OpenSSL "Pass Phrase arguments"

If you want to supply a password for the output-file, you will need the (awkwardly named) -passout parameter.

This is a multi-dimensional parameter and allow you to read the actual password from a number of sources. Such as file or from an environment variable. Or straight from the commandline (least secure). Below are examples for each of these usages.

(The official manpage lists even more password-sources in the "Pass Phrase Arguments" section.)

Example: password from command line with "pass:"

$ openssl req -new -passout pass:"Pomegranate" -subj "/CN=sample.myhost.com" -out newcsr.csr -sha512 -newkey rsa:2048
Generating a 2048 bit RSA private key
................................................................................................................................+++
......................+++
writing new private key to 'privkey.pem'
-----


$ openssl rsa -in privkey.pem -passin pass:'Pomegranate' | head -n2
writing RSA key
-----BEGIN RSA PRIVATE KEY-----
MIIEpQIBAAKCAQEAsSP5kLRPP8wPODrnvuAeeoqGMqTOvRULL423vv6+zjYhwPUi

Example: password from variable with "env:"

$ export MYPASS='Elderberry'


$ openssl req -new -passout env:MYPASS -subj "/CN=sample.myhost.com" -out newcsr.csr -sha512 -newkey rsa:2048
Generating a 2048 bit RSA private key
............................+++
.....................+++
writing new private key to 'privkey.pem'
-----


$ openssl rsa -in privkey.pem -passin pass:'Elderberry' | head -n2
writing RSA key
-----BEGIN RSA PRIVATE KEY-----
MIIEpQIBAAKCAQEAv0NnBnigPp+O9G4UXc0qSyeELdJJjTmnO9GEtE5GlPGoK7vW

Example: password from file with "file:"

$ echo "Farkleberry" > password.txt


$ openssl req -new -passout file:password.txt -subj "/CN=sample.myhost.com" -out newcsr.csr -sha512 -newkey rsa:2048
Generating a 2048 bit RSA private key
......................+++
...........+++
writing new private key to 'privkey.pem'
-----


$ openssl rsa -in privkey.pem -passin pass:'Farkleberry' | head -n2
writing RSA key
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAsHICgYvqe4i9CIR5eQk38JJmuTaJQvyxPH9S+BahT5XWh88z
  • LOL, so that's what nodes stands for. Guessing that option preceded both asn1-kludge and set_serial – bvj Apr 1 at 18:37
2

You can update the key with a password with the following command:

openssl rsa -des3 -in server.key -out server.key.new

Then use mv server.key.new server.key to ovewrite the old key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.