13

Similar to how it can be easily done for RSA:

openssl req -x509 -nodes -newkey rsa:2048 -rand /dev/urandom -keyout example.key -out example.crt -days 365

I'd like to generate an ECDSA cert/key in one step. I've tried:

openssl req -x509 -nodes -newkey ec:secp384r1 -keyout ecdsa.pem -out mycert.crt -days 30

Returns the below error

Can't open parameter file secp384r1.

I am trying to specify the curve to use. If a key file exists, then you can specify it with ec:example-ecdsa.pem and it will work.

Possibly something like this could work with tweaking:

openssl req -new -x509 -nodes -newkey ec:$(openssl ecparam -name secp384r1) -keyout cert.key -out cert.crt -days 3650
|improve this question
  • Why would you use /dev/urandom? If you care about safety, use /dev/random/, which has much higher entropy. /dev/random will always wait until it has good entropy, while /dev/urandom is unblocking. – Diti May 19 '14 at 9:19
  • 7
    @Diti: sorry, you got it completely in reverse. /dev/random is NOT "safer" than /dev/urandom; in fact, it is rather the opposite, precisely since /dev/random blocks. See: 2uo.de/myths-about-urandom – Tom Leek Jun 17 '14 at 10:47
  • 1
    @Tom: Don't feel sorry for pointing that mistake out, I actually appreciated that; your link was a great read! Thank you! I should be careful when giving cryptography advise, haha! – Diti Jun 17 '14 at 13:14
17

This seemed to be the command you want:

openssl req -new -x509 -nodes -newkey ec:<(openssl ecparam -name secp384r1) -keyout cert.key -out cert.crt -days 3650
|improve this answer
  • You are my hero! – Huan Jun 7 at 16:24
6
openssl ecparam -name secp521r1 -genkey -param_enc explicit -out private-key.pem
openssl req -new -x509 -key private-key.pem -out server.pem -days 730

Creating Self-Signed ECDSA SSL Certificate using OpenSSL is working for me.

You can test certificates after generating as follows.

openssl ecparam -in private-key.pem -text -noout
|improve this answer
  • 1
    I am well aware of that. My question specifically asked how it can be done in one step. – Python Novice May 18 '14 at 2:31
  • command1 && command2 will work as single line executing two commands. Even that $(command) is close to that. In that you are fetching out of one command to other. – Kasun May 18 '14 at 8:04
  • @Kasun The poster was asking how to call openssl once, creating the keypair and cert at the same time, using the ec:filename option. – mikemaccana Jul 11 '16 at 10:26
5

Use -pkeyopt

openssl req -x509 -nodes -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -keyout ecdsa.pem -out mycert.crt -days 30

According to man req:

OPTIONS
       -pkeyopt opt:value
           set the public key algorithm option opt to value. The precise set of options supported depends on the public key algorithm used and its implementation. See KEY GENERATION OPTIONS in the genpkey manual page for more details.

So then looking at man genpkey:

EC PARAMETER GENERATION OPTIONS
       The EC parameter generation options below can also be supplied as EC key generation options. This can (for example) generate a key from a named curve without the need to use an explicit parameter file.

       ec_paramgen_curve:curve
           the EC curve to use. OpenSSL supports NIST curve names such as "P-256".

       ec_param_enc:encoding
           the encoding to use for parameters. The "encoding" parameter must be either "named_curve" or "explicit".
|improve this answer
0

One liner to create ECC secp384r1 key + CSR with Alternative Subject Names:

export FQDN="www.example.com" ; export FQDNA="DNS.1=$FQDN, DNS.2=example.com, DNS.3=es.example.com, DNS.4=it.example.com, DNS.5=pt.example.com, DNS.6=de.example.com, DNS.7=fr.example.com" ; openssl req -new -nodes -newkey ec:<(openssl ecparam -name secp384r1 -rand /dev/urandom) -keyout $FQDN.secp384r1.key -out $FQDN.secp384r1.csr -subj "/C=US/ST=Minnesota/L=Minneapolis/O=Me and my Feast/OU=IT Dept./CN=$FQDN/subjectAltName=$FQDNA"
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.