Quiz Entry - updated: 2026.10.30
What does each part of openssl req -nodes -new -x509 -keyout garagedoor.key -out garagedoor.cert do?
It creates a new RSA key pair and, instead of a certificate request, directly a self-signed X.509 certificate. The private key goes unencrypted into garagedoor.key, the certificate into garagedoor.cert.
| Part | Meaning |
|---|---|
openssl req |
The tool for certificate requests (CSRs). With -x509 it makes a certificate instead |
-new |
Create a new request, prompting for the subject fields (country, organisation, Common Name, …). Without -key, it also generates a new key: RSA 2048 bits by default |
-x509 |
Output a self-signed certificate rather than a request for a CA to sign |
-nodes |
"No DES": write the private key unencrypted. Deprecated since OpenSSL 3.0 in favour of -noenc |
-keyout garagedoor.key |
Where the new private key goes. Stays on the server |
-out garagedoor.cert |
Where the certificate goes. Copied to every client |
Three details matter in practice:
- Unencrypted key. Without
-nodesOpenSSL asks for a passphrase, and the Node server would need it at every start. The price is that whoever can read the key file can impersonate the server, so the file must be readable only by the server's user (chmod 600). - Validity is 30 days unless
-daysis given. The certificate in the demo log runs from 21 October to 20 November: exactly that default. - The Common Name you type at the prompt must be the address clients connect to, here the server's IP address. Current clients check the Subject Alternative Name instead, so a better command adds it explicitly:
openssl req -x509 -newkey rsa:2048 -noenc -days 365 \
-keyout garagedoor.key -out garagedoor.cert \
-subj "/CN=192.168.16.33" -addext "subjectAltName=IP:192.168.16.33"
Go deeper:
OpenSSL 3.0 — openssl-req — every option, including the 30-day default and -addext.- Wikipedia — X.509 — the fields of a certificate: subject, issuer, validity, public key, extensions.