what is the difference between the commands below :

command 1:

openssl x509 -req -in certs/server_csr.pem -CA certs/intermediate_cert.pem -CAkey private/intermediate_key.pem -out server_cert.pem -CAcreateserial -days 365 -sha256 -extfile server_cert_ext.cnf

command 2:

openssl ca -config ~/myCA/openssl_intermediate.cnf -extensions server_cert -days 375 -notext -md sha256 -in certs/server_csr.pem -out server_cert.pem

Both commands sign csr request and generate a server certificate, but I can't tell what is the difference between them.

  • So, you want to know the difference between x509 -ca and ca?
    – schroeder
    Jun 23, 2023 at 20:00
  • @schroeder yes in a way. Jun 26, 2023 at 7:09

1 Answer 1


The difference is that the second command uses the entire CA “infrastructure” defined in the CA configuration and consisting of, for example, a certificate database, a counter for the serial numbers, a policy for validating Distinguished Names and a set of default settings (algorithms, key sizes etc.).

The first command is an ad-hoc way of creating a certificate. It does not use any CA configuration (just the key), it does not store the certificate in a database, and it does not use a serial number counter. Instead, the serial number 01 is used (and a new file which may be used as a counter in future commands is created).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .