I want to export the configuration details from an existing CSR or Certificate to a config file which I can use with OpenSSL to generate a new CSR.

Background Our CA has changed. For the old one, I submitted a CSR and a list of subjectAltNames and the CA team sorted it out. For the new CA, I have to submit a CSR with the subjectAltNames included. It's a critical time of the year and I can't make a mistake, so I'd rather export the configuration file than recreate it manually, if that's possible. It's for a Windows server. I don't know how the original CSR was created - there's no existing config file. I've exported the private key from the windows key store, for use with OpenSSL. I have the original CSR and the certificate.


I also had this question, and tying a number of threads together, I cobbled together this bash script to create a config file:

for pem in $1 ; do
echo "[ req ]\ndefault_bits\t= 4096\ndistinguished_name\t= req_distinguished_name\nreq_extensions\t= req_ext\n[ req_distinguished_name ]" ; 

    for att in `openssl x509 -in $pem -text -noout | grep Subject: | cut -d: -f2 ` ;  

        do VALUE=`echo $att | cut -d= -f2-9 `; 
            case $att in 
              \ C=*) echo "countryName_default = $VALUE" ;; 
              \ ST=*) echo "StateOrProvinceName_default = $VALUE" ;; 
              \ L=*) echo "localityName_default = $VALUE";; 
              \ O=*) echo "organizationName_default = $VALUE" ;; 
              \ OU=*)  echo "organizationUnitName_default = $VALUE" ;; 
              \ CN=*)  echo "commonName_default = $VALUE" ;; 

        openssl x509 -in $pem -text | grep -A1 Subject\ Alternative\ Name | tail -1 | xargs echo "[ req_ext ]\nsubjectAltName = "
  • Thanks. I carried on searching after posting the question and the general answer seemed to be 'not possible' so this is really helpful. Dec 7 '20 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.