I would like to know how to use the -extensions parameter of openssl req command to generate a csr with basicConstraint=CA:False, Please not i do not want to use a ssl configuration file but to generate the csr with command line only without referring to a openssl.cnf file. Is this possible ?

Thank you.


... how to use the -extensions parameter of openssl req command to generate a csr with basicConstraint=CA:False

The -extensions parameter is not used at all when generating a CSR. It is used for generating certificate extensions when generating a certificate (when -x509 option is given). For specifying request extensions the (i.e. for the CSR) the -reqexts option has to be used.

Up until OpenSSL 1.1.1 there was no way in the openssl req command itself to do what you want, i.e. not using a config file. Depending on the OS there might be a way though to "magically" create a config file on the fly and use it. For example in Linux with bash shell the following can be done:

$ openssl req -new -key key.pem -out req.pem -reqexts bc \
  -config <(cat /etc/ssl/openssl.cnf; printf "[bc]\nbasicConstraints=CA:false\n")

OpenSSL 1.1.1 added the option -addext and now it can be written like this (thanks to dave_thompson_085 to point out):

$ openssl req -new -key key.pem -out req.pem \
   -addext "basicConstraints=CA:false"
  • New in 1.1.1 is a commandline option -addext which can be used instead of a config section. Also, you've misspelled the first occurrence of reqexts. – dave_thompson_085 Jun 12 at 23:39
  • @dave_thompson_085: Thanks for pointing out -addext and the typo. I've fixed and extended the question. – Steffen Ullrich Jun 13 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.