26

Similar to how it can be easily done for RSA:

openssl req -x509 -nodes -newkey rsa:2048 -rand /dev/urandom -keyout example.key -out example.crt -days 365

I'd like to generate an ECDSA cert/key in one step. I've tried:

openssl req -x509 -nodes -newkey ec:secp384r1 -keyout ecdsa.pem -out mycert.crt -days 30

Returns the below error

Can't open parameter file secp384r1.

I am trying to specify the curve to use. If a key file exists, then you can specify it with ec:example-ecdsa.pem and it will work.

Possibly something like this could work with tweaking:

openssl req -new -x509 -nodes -newkey ec:$(openssl ecparam -name secp384r1) -keyout cert.key -out cert.crt -days 3650
Improve this question
3
  • Why would you use /dev/urandom? If you care about safety, use /dev/random/, which has much higher entropy. /dev/random will always wait until it has good entropy, while /dev/urandom is unblocking.
    – Diti
    May 19, 2014 at 9:19
  • 7
    @Diti: sorry, you got it completely in reverse. /dev/random is NOT "safer" than /dev/urandom; in fact, it is rather the opposite, precisely since /dev/random blocks. See: 2uo.de/myths-about-urandom
    – Tom Leek
    Jun 17, 2014 at 10:47
  • 1
    @Tom: Don't feel sorry for pointing that mistake out, I actually appreciated that; your link was a great read! Thank you! I should be careful when giving cryptography advise, haha!
    – Diti
    Jun 17, 2014 at 13:14

4 Answers 4

Reset to default
28

This seemed to be the command you want:

openssl req -new -x509 -nodes -newkey ec:<(openssl ecparam -name secp384r1) -keyout cert.key -out cert.crt -days 3650
Improve this answer
3
  • You are my hero!
    – Huan
    Jun 7, 2019 at 16:24
  • It calls openssl twice. Not that it is a problem in itself, but when running openssl from windows this solution does not work. That's why i'd reccomend the solution posted by @Jude
    – Andre Soares
    Feb 26, 2020 at 20:08
  • 1
    Nice solution. As an additional information -- in case you would want to create an Ed25519 key, you go with this one liner: openssl req -new -x509 -nodes -newkey ed25519 -keyout cert.key -out cert.crt -days 3650
    – Pawel Os.
    Nov 2, 2021 at 9:13
19

Use -pkeyopt

openssl req -x509 -nodes -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -keyout ecdsa.pem -out mycert.crt -days 30

According to man req:

OPTIONS
       -pkeyopt opt:value
           set the public key algorithm option opt to value. The precise set of options supported depends on the public key algorithm used and its implementation. See KEY GENERATION OPTIONS in the genpkey manual page for more details.

So then looking at man genpkey:

EC PARAMETER GENERATION OPTIONS
       The EC parameter generation options below can also be supplied as EC key generation options. This can (for example) generate a key from a named curve without the need to use an explicit parameter file.

       ec_paramgen_curve:curve
           the EC curve to use. OpenSSL supports NIST curve names such as "P-256".

       ec_param_enc:encoding
           the encoding to use for parameters. The "encoding" parameter must be either "named_curve" or "explicit".
Improve this answer
3
  • 1
    This is the only answer that really calls openssl just once
    – Andre Soares
    Feb 26, 2020 at 20:06
  • and the only one that can be run from a cloud-init script where the input redirection in the other example freaks out
    – grenade
    Apr 22, 2021 at 7:50
  • A note here: This seems to need a bit more modern OpenSSL. It does not work with LibreSSL 2.8.3 and I also think it does not work with OpenSSL 1.0.2. However this method also works fine on windows since it does not use unix shell specific redirection.
    – plaisthos
    Jul 29, 2021 at 11:30
6 
openssl ecparam -name secp521r1 -genkey -param_enc explicit -out private-key.pem
openssl req -new -x509 -key private-key.pem -out server.pem -days 730

Creating Self-Signed ECDSA SSL Certificate using OpenSSL is working for me.

You can test certificates after generating as follows.

openssl ecparam -in private-key.pem -text -noout
Improve this answer
3
  • 2
    I am well aware of that. My question specifically asked how it can be done in one step.
    – Python Novice
    May 18, 2014 at 2:31
  • command1 && command2 will work as single line executing two commands. Even that $(command) is close to that. In that you are fetching out of one command to other.
    – Kasun
    May 18, 2014 at 8:04
  • 1
    @Kasun The poster was asking how to call openssl once, creating the keypair and cert at the same time, using the ec:filename option.
    – mikemaccana
    Jul 11, 2016 at 10:26
1

One liner to create ECC secp384r1 key + CSR with Alternative Subject Names:

export FQDN="www.example.com" ; export FQDNA="DNS.1=$FQDN, DNS.2=example.com, DNS.3=es.example.com, DNS.4=it.example.com, DNS.5=pt.example.com, DNS.6=de.example.com, DNS.7=fr.example.com" ; openssl req -new -nodes -newkey ec:<(openssl ecparam -name secp384r1 -rand /dev/urandom) -keyout $FQDN.secp384r1.key -out $FQDN.secp384r1.csr -subj "/C=US/ST=Minnesota/L=Minneapolis/O=Me and my Feast/OU=IT Dept./CN=$FQDN/subjectAltName=$FQDNA"
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.