Openssl x509v3 Extended Key Usage

openssl x509certificate

David Caissy · Jun 13, 2013 · Viewed 51.3k times · Source

I know you can specify the purpose for which a certificate public key can be used for by adding a line like this one in the openssl.cfg file:

extendedKeyUsage=serverAuth,clientAuth

But since I have several certificates to create, each with a different extended key usage, is it possible to specify which attribute I need in the command line (without using the openssl.cfg file)? Something like:

openssl req -newkey rsa:4096 \
            -extendedKeyUsage "serverAuth,clientAuth" \
            -keyform PEM \
            -keyout server-key.pem \
            -out server-req.csr \
            -outform PEM

Thanks!

Answer

You can only use something like this:

openssl -extensions mysection -config myconfig.cnf

and myconfig.cnf:

[mysection]
keyUsage         = digitalSignature
extendedKeyUsage = codeSigning

I am not aware of command line interface to this functionality.

Openssl x509v3 Extended Key Usage

Answer

Related questions