The man page for req or in new versions possibly openssl-req on your system or on the web (other releases linked at right) describes the first group at the heading CONFIGURATION FILE FORMAT and the syntax for the second and third groups at DISTINGUISHED NAME AND ATTRIBUTE SECTION FORMAT.īoth the components of a DistinguishedName (aka DN, X501Name etc, which are themselves called attributes) and the attributes (if any) of a CSR are identified by ASN.1 Object Identifiers aka OIDs, making them in principle arbitrarily extensible, and so are extension values (see more below). Requested extensions these are actually all encapsulated into a single attribute with OID 1.2.840.113549.1.9.14, but because they correspond to extensions in a cert or CRL (where they are not in an attribute) OpenSSL configures them separately 'attributes' (directly) in the CSR, see rfc2986, which use the same syntax as DN and can be prompted or hardcoded Values that go in the subject Distinguished Name these are usually prompted for from the user/terminal, but can be hardcoded, or overridden using option -subj Options or settings that control the operation of the req command itself, like the default size of key to generate (for RSA) or keyfile to write, and hash to use in signing There are four types of configuration used by openssl req to generate a CSR: Meta: this is not really a programming/development question and probably belongs on serverfault or maybe superuser.

Openssl config file format