I want to export the configuration details from an existing CSR or Certificate to a config file which I can use with OpenSSL to generate a new CSR.

Background Our CA has changed. For the old one, I submitted a CSR and a list of subjectAltNames and the CA team sorted it out. For the new CA, I have to submit a CSR with the subjectAltNames included. It's a critical time of the year and I can't make a mistake, so I'd rather export the configuration file than recreate it manually, if that's possible. It's for a Windows server. I don't know how the original CSR was created - there's no existing config file. I've exported the private key from the windows key store, for use with OpenSSL. I have the original CSR and the certificate.

1 Answer 1


I also had this question, and tying a number of threads together, I cobbled together this bash script to create a config file:

for pem in $1 ; do
echo "[ req ]\ndefault_bits\t= 4096\ndistinguished_name\t= req_distinguished_name\nreq_extensions\t= req_ext\n[ req_distinguished_name ]" ; 

    for att in `openssl x509 -in $pem -text -noout | grep Subject: | cut -d: -f2 ` ;  

        do VALUE=`echo $att | cut -d= -f2-9 `; 
            case $att in 
              \ C=*) echo "countryName_default = $VALUE" ;; 
              \ ST=*) echo "StateOrProvinceName_default = $VALUE" ;; 
              \ L=*) echo "localityName_default = $VALUE";; 
              \ O=*) echo "organizationName_default = $VALUE" ;; 
              \ OU=*)  echo "organizationUnitName_default = $VALUE" ;; 
              \ CN=*)  echo "commonName_default = $VALUE" ;; 

        openssl x509 -in $pem -text | grep -A1 Subject\ Alternative\ Name | tail -1 | xargs echo "[ req_ext ]\nsubjectAltName = "
  • Thanks. I carried on searching after posting the question and the general answer seemed to be 'not possible' so this is really helpful. Dec 7, 2020 at 16:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .