I have a public key/private key pair i generated using two primes p and q. I now need to use openssl to sign and create the certificate. I heard req utility and wrote this from the man pages.

openssl req -x509 -days 365 -nodes -key inputfile.txt -keyout key.pem -out cert.pem

But what details should I specify in inputfile.txt and is there a particular format for that?


Here's nice walkthrough of all the steps you need to do in order to generate self-signed ceritficate.


You are using wrong parameters. When you are generating new certificate, you've got two inputs - request and private key and one output - the signed certificate. The correct command therefore would be: openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt where

  • x509 req : you are requesting PKI functionality
  • days 365 : validitity period for the certificate
  • in : certificate signing request
  • signkey : private key used to sign the certificate
  • out : output file for the generated certificate

Hope this helps.

  • Actually for selfsigned you can do it in one step by combining the -new and -x509 options of req. Separate req and x509, or sometimes better ca, are needed to implement a (private) CA structure. – dave_thompson_085 Feb 8 '15 at 21:59

req -x509 (without -new) requires a CSR on input and you don't say anything about having created a CSR. -key requires a "private-key" file (which in the PKCS#1 CRT form which OpenSSL uses is really keypair) and you say you have that, although it would not normally use a .txt extension. -keyout and -nodes are useless when -key is input; they are for the case where req generates a new keypair along with the CSR or cert.

You may want to use req -new -x509 which in effect generates a CSR for your keypair and name and then converts it to a self-signed cert automatically. For that you need to supply the subject Distinguished Name (commonly Organization, CommonName, and so on, but can be configured) and validity, and optionally but usually cert extensions, which vary depending on what your cert is intended for, either in a config file, which can either be specified or use a default that depends on your build/package, or commandline options, or a combination of both.

Did you try reading the manpages for req and for x509v3_config to which it refers? There's a reason those total 15 kilobytes which I don't propose to retype here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.