I have been using easyrsa to generate client certificates for my application using the method described here.

The build-client-full command generates a fresh private key for each client. This is what I currently use... run build-client-full send the private key, certificate and ca cert to the client.

What I want to do is have the client generate their own private key locally, send me their public key, and I make the certificate and send it to the client where me as the CA decides the properties of the cert (Common name specifically).

How do I go about it? If I have the client generate CSR, how do I edit the properties in easyrsa before signing? Is easyrsa too simple for this and I need something more complex?

1 Answer 1


You can use import-req command to import client csr and then sign it. For more info check the documentation of easy-rsa program

  • Yes, but how would I edit the csr before(or after) doing import-req? Jun 1, 2015 at 19:22
  • If the request is done by rules you do not need to edit it by hand. If users want to create request by self should follow the rules Jun 1, 2015 at 19:26
  • Screw the rules. I want to decide what goes into the cert. Only thing I want from the user is public key. I dont want to tell the user "hey make csr with these paramaters and send it to me". I want to tell them "send me your public key and I give you cert to use". Jun 1, 2015 at 22:12
  • In such case you can create web form where they will fill and enter info and you will set the rest of the info Jun 2, 2015 at 20:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .