Similar to how it can be easily done for RSA:
openssl req -x509 -nodes -newkey rsa:2048 -rand /dev/urandom -keyout example.key -out example.crt -days 365
I'd like to generate an ECDSA cert/key in one step. I've tried:
openssl req -x509 -nodes -newkey ec:secp384r1 -keyout ecdsa.pem -out mycert.crt -days 30
Returns the below error
Can't open parameter file secp384r1.
I am trying to specify the curve to use. If a key file exists, then you can specify it with ec:example-ecdsa.pem
and it will work.
Possibly something like this could work with tweaking:
openssl req -new -x509 -nodes -newkey ec:$(openssl ecparam -name secp384r1) -keyout cert.key -out cert.crt -days 3650
/dev/urandom
? If you care about safety, use/dev/random/
, which has much higher entropy./dev/random
will always wait until it has good entropy, while/dev/urandom
is unblocking./dev/random
is NOT "safer" than/dev/urandom
; in fact, it is rather the opposite, precisely since/dev/random
blocks. See: 2uo.de/myths-about-urandom