I have been using easyrsa to generate client certificates for my application using the method described here.

The build-client-full command generates a fresh private key for each client. This is what I currently use... run build-client-full send the private key, certificate and ca cert to the client.

What I want to do is have the client generate their own private key locally, send me their public key, and I make the certificate and send it to the client where me as the CA decides the properties of the cert (Common name specifically).

How do I go about it? If I have the client generate CSR, how do I edit the properties in easyrsa before signing? Is easyrsa too simple for this and I need something more complex?


You can use import-req command to import client csr and then sign it. For more info check the documentation of easy-rsa program

  • Yes, but how would I edit the csr before(or after) doing import-req? – Sajal Kayan Jun 1 '15 at 19:22
  • If the request is done by rules you do not need to edit it by hand. If users want to create request by self should follow the rules – Romeo Ninov Jun 1 '15 at 19:26
  • Screw the rules. I want to decide what goes into the cert. Only thing I want from the user is public key. I dont want to tell the user "hey make csr with these paramaters and send it to me". I want to tell them "send me your public key and I give you cert to use". – Sajal Kayan Jun 1 '15 at 22:12
  • In such case you can create web form where they will fill and enter info and you will set the rest of the info – Romeo Ninov Jun 2 '15 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.