How to Use OpenSSL to Generate X.509 Certificate Request

In this tutorial, let’s learn how to use OpenSSL to generate X.509 certificate request.

Certificate signing request is a message sent from an applicant to a certificate authority, which usually includes:

  1. Country Name (2 letter code) [US]
  2. State or Province Name (full name) [BC]
  3. Locality Name (e.g., city) [Vancouver]
  4. Organization Name (e.g., company) [My Company Ltd]
  5. Organizational Unit Name (e.g., section)
  6. Common Name (e.g., your name or your server’s hostname)
  7. Email Address

Implementation Steps:

  1. Generate RSA key
  2. Set version
  3. Set subject
  4. Set public key
  5. Set sign key
  6. Free

Code & Result:

#include <stdio.h>
#include <iostream>
#include <openssl/rsa.h>
#include <openssl/pem.h>

bool gen_X509Req()
	int				ret = 0;
	RSA				*r = NULL;
	BIGNUM			*bne = NULL;

	int				nVersion = 1;
	int				bits = 2048;
	unsigned long	e = RSA_F4;

	X509_REQ		*x509_req = NULL;
	X509_NAME		*x509_name = NULL;
	EVP_PKEY		*pKey = NULL;
	RSA				*tem = NULL;
	BIO				*out = NULL, *bio_err = NULL;

	const char		*szCountry = "CA";
	const char		*szProvince = "BC";
	const char		*szCity = "Vancouver";
	const char		*szOrganization = "Dynamsoft";
	const char		*szCommon = "localhost";

	const char		*szPath = "x509Req.pem";

	// 1. generate rsa key
	bne = BN_new();
	ret = BN_set_word(bne,e);
	if(ret != 1){
		goto free_all;

	r = RSA_new();
	ret = RSA_generate_key_ex(r, bits, bne, NULL);
	if(ret != 1){
		goto free_all;

	// 2. set version of x509 req
	x509_req = X509_REQ_new();
	ret = X509_REQ_set_version(x509_req, nVersion);
	if (ret != 1){
		goto free_all;

	// 3. set subject of x509 req
	x509_name = X509_REQ_get_subject_name(x509_req);

	ret = X509_NAME_add_entry_by_txt(x509_name,"C", MBSTRING_ASC, (const unsigned char*)szCountry, -1, -1, 0);
	if (ret != 1){
		goto free_all;

	ret = X509_NAME_add_entry_by_txt(x509_name,"ST", MBSTRING_ASC, (const unsigned char*)szProvince, -1, -1, 0);
	if (ret != 1){
		goto free_all;

	ret = X509_NAME_add_entry_by_txt(x509_name,"L", MBSTRING_ASC, (const unsigned char*)szCity, -1, -1, 0);
	if (ret != 1){
		goto free_all;

	ret = X509_NAME_add_entry_by_txt(x509_name,"O", MBSTRING_ASC, (const unsigned char*)szOrganization, -1, -1, 0);
	if (ret != 1){
		goto free_all;

	ret = X509_NAME_add_entry_by_txt(x509_name,"CN", MBSTRING_ASC, (const unsigned char*)szCommon, -1, -1, 0);
	if (ret != 1){
		goto free_all;

	// 4. set public key of x509 req
	pKey = EVP_PKEY_new();
	EVP_PKEY_assign_RSA(pKey, r);
	r = NULL;	// will be free rsa when EVP_PKEY_free(pKey)

	ret = X509_REQ_set_pubkey(x509_req, pKey);
	if (ret != 1){
		goto free_all;

	// 5. set sign key of x509 req
	ret = X509_REQ_sign(x509_req, pKey, EVP_sha1());	// return x509_req->signature->length
	if (ret <= 0){
		goto free_all;

	out = BIO_new_file(szPath,"w");
	ret = PEM_write_bio_X509_REQ(out, x509_req);

	// 6. free


	return (ret == 1);

int main(int argc, char* argv[]) 
	return 0;

You can feel free to download the sample code, and run it in Visual Studio.

3 thoughts on “How to Use OpenSSL to Generate X.509 Certificate Request

  1. Thank you so much for the tutorial, but it is showing the error “Could not display ‘x509Req.pem’ Reason: Unrecognized or unsupported data.”

    Could you please explain why?.

  2. Thank you so much!!!

    This info has been very helpful.
    May I ask something new now?
    I’m implemented some OpenSSL functions in one embedded device. Unfortunately I only have a few functions available. So far I’ve been able to generate an RSA private key and now I need to generate the CSR. My library does NOT have any of the functions such as X509_REQ_new(), X509_REQ_get_subject_name() etc. Therefore I’m building the CSR by means of creating a DER file directly.

    The CSR in DER format is decoded as follows:
    1.- ASN1 Sequence
    2.- Version
    3.- Subject(s) name(s)
    4.- Type of encryption
    5.- Modulus & Exponent (from my RSA Key)
    6.- Attributes
    7.- Signature (here is where my problem lies)

    What do I need to sign in order to build that part?

    If I had all the OpenSSL functions available I would use:
    “X509_REQ_sign(x509_req, pKey, EVP_sha1());”

    But as I said before I don’t have any of the X509 objects available.
    Thank you in advance!

Comments are closed.