openssl-req(1)
Create and process certificate requests (PKCS#10 format) for X.509 certificates.
Synopsis
openssl req [OPTIONS] [-in FILE] [-out FILE]Description
The openssl req command generates X.509 certificate signing requests (CSRs) or displays the contents of existing requests. It can create new private keys, self-sign certificates, and manage certificate request attributes like subject distinguished names and extensions.
This is the primary tool for initiating the certificate lifecycle: generate a CSR, submit it to a Certificate Authority (CA), and receive a signed certificate in return. It can also verify requests and convert between formats.
Common options
| Flag | What it does |
|---|---|
-new | Generate a new certificate request; prompts for subject fields |
-newkey rsa:2048 | Generate a new private key (RSA 2048-bit); use with -new |
-key FILE | Use an existing private key file instead of generating a new one |
-in FILE | Read certificate request from FILE (display/verify existing CSR) |
-out FILE | Write the certificate request to FILE |
-x509 | Output a self-signed certificate instead of a CSR |
-days N | Certificate validity period in days (for self-signing with -x509) |
-subj '/CN=example.com/O=Org' | Set subject name directly; avoid interactive prompts |
-config FILE | Use custom OpenSSL configuration file for defaults and extensions |
-text | Display the request contents in human-readable text format |
-noout | Omit the PEM-encoded request output; use with -text or -verify |
-verify | Verify the CSR signature is valid |
Examples
Generate a new 2048-bit RSA key and certificate request; prompts for subject details
openssl req -new -newkey rsa:2048 -out request.csr -keyout private.keyCreate a CSR using an existing private key with non-interactive subject information
openssl req -new -key existing_key.pem -out request.csr -subj '/CN=example.com/O=MyCompany/C=US'Display the contents of an existing certificate request in readable format
openssl req -in request.csr -text -nooutGenerate a self-signed certificate valid for 365 days (useful for testing)
openssl req -new -x509 -newkey rsa:2048 -out cert.pem -keyout key.pem -days 365Verify the signature and validity of a certificate signing request
openssl req -in request.csr -noout -verifyGenerate a CSR with 4096-bit key using custom OpenSSL configuration for extensions
openssl req -new -newkey rsa:4096 -keyout key.pem -out csr.pem -config myconfig.confExtract and display only the subject line from a CSR
openssl req -in request.csr -noout -text | grep 'Subject:'