I would like to know how to use the -extensions parameter of openssl req command to generate a csr with basicConstraint=CA:False, Please not i do not want to use a ssl configuration file but to generate the csr with command line only without referring to a openssl.cnf file. Is this possible ?

Thank you.


1 Answer 1


... how to use the -extensions parameter of openssl req command to generate a csr with basicConstraint=CA:False

The -extensions parameter is not used at all when generating a CSR. It is used for generating certificate extensions when generating a certificate (when -x509 option is given). For specifying request extensions the (i.e. for the CSR) the -reqexts option has to be used.

Up until OpenSSL 1.1.1 there was no way in the openssl req command itself to do what you want, i.e. not using a config file. Depending on the OS there might be a way though to "magically" create a config file on the fly and use it. For example in Linux with bash shell the following can be done:

$ openssl req -new -key key.pem -out req.pem -reqexts bc \
  -config <(cat /etc/ssl/openssl.cnf; printf "[bc]\nbasicConstraints=CA:false\n")

OpenSSL 1.1.1 added the option -addext and now it can be written like this (thanks to dave_thompson_085 to point out):

$ openssl req -new -key key.pem -out req.pem \
   -addext "basicConstraints=CA:false"
  • New in 1.1.1 is a commandline option -addext which can be used instead of a config section. Also, you've misspelled the first occurrence of reqexts. Jun 12, 2021 at 23:39
  • @dave_thompson_085: Thanks for pointing out -addext and the typo. I've fixed and extended the question. Jun 13, 2021 at 4:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .