Country Name (2 letter code) []: (FR for example)
State or Province Name (full name) [Some-State]: (the name of your state in full letters)
Locality Name (eg, city) []: (the name of your city)
Organization Name (eg, company) []: (the name of your organization)
Organizational Unit Name (eg, section) []: (let blank — advised — or provide a generic term such as «IT department»)
Common Name (eg, YOUR name) []: (the name of the site to be secured)
Email Address []: (let blank)

Let the other fields blank, they are optional.

So you get 2 files: site-file.key and site-file.csr. Keep the private key file (site-file.key) securely, then copy / paste the content of the site-file.csr file into the order form at TBS CERTIFICATES.
Warning: Never send us or a third party the private key (site-file.key) otherwise the security of your site may no longer be ensured.

OpenSSL: cases of uses

OpenSSL is the toolbox mainly used by opensource software for SSL implementation.

Running Openssl from a bash script on windows — Subject does not start with ‘/’

In my script I have:

Running this on Windows in Git Bash 3.1 gives:

Tried escaping the subj like so: -subj \»/C=UK/ST=someplace/L=Provo/O=Achme/CN=$\»

Still doesn’t work. Any ideas?

2 Answers 2

This issue is specific to MinGW/MSYS which is commonly used as part of the Git for Windows package.

The solution is to pass the -subj argument with leading // (double forward slashes) and then use \ (backslashes) to separate the key/value pairs. Like this:

This will then be magically passed to openssl in the expected form:

So to answer the specific question, you should change the -subj line in your script to the following.

That should be all you need.

What is this magic?

For those curious about exactly what is going on here, I can explain this mystery. The reason is that MSYS reasonably assumes that arguments containing slashes are actually paths. And when those arguments are passed to an executable that haven’t been compiled specifically for MSYS (like openssl in this case) then it will convert POSIX paths to Win32 paths. The rules for this conversion are quite complex as MSYS tries its best to cover most common scenarios for interoperability. This also explains why using openssl from a windows command prompt ( cmd.exe ) works fine, because no magical conversions are made.

You can test the conversion like this.

We can’t use the echo executable that comes with MSYS since it was compiled for MSYS, instead we’ll use the echo builtin in cmd . Notice that since cmd switches starts with / (common for windows commands) we need to handle that with double slashes. As we can see in the output the argument was expanded to a windows path and it becomes clear why openssl does indeed claim that Subject does not start with ‘/’. .

Let’s see some more conversions.

Double slashes makes MSYS believe the argument is a windows style switch which results in stripping a / only (no path conversion). You would think that with this we could just use slashes to add more key/value pairs. Let’s try that.

Suddenly the double slashes in the start isn’t stripped down. This is because now, with a slash following the initial double slashes, MSYS thinks we are referencing a UNC path (e.g. //server/path). If this was passed to openssl it would skip the first key/value saying Subject Attribute /O has no known NID, skipped .

Here is the relevant rule from the MinGW wiki explaining this behavior:

• An argument starting with 2 or more / is considered an escaped Windows style switch and will be passed with the leading / removed and all \ changed to /.
  • Except that if there is a / following the leading block of /, the argument is considered to be a UNC path and the leading / is not removed.

In this rule we can see the method we could use to create the argument we want. Since all \ that follows in an argument starting with // will be converted to plain / . Let’s try that out.

And as we can see it does work.

Hope this demystifies the magic a little bit.

Installing OpenSSL on Windows 10 and updating PATH

I recently discovered a convoluted way to build an iOS .ipa package without using a MacBook. It involves many steps, one of which is using OpenSSL for Windows. Instead of creating one huge blog post with all steps defined in detail, I decided to split them up in bite-size articles. This is one of them. Here I will teach you to do the following:

• Install OpenSSL
• Add OpenSSL to your PATH

Install OpenSSL

This step is a simple one. Simply choose the version that applies to your PC from here. As example, I chose the Win64 OpenSSL v1.1.1g MSI (not the light version) from the table:

Run the EXE or MSI with default settings till completion and that should take care of installing OpenSSL!

Add OpenSSL to your PATH

Why do we want to do this? First off, it’s not a necessity, it just makes it more convenient to use OpenSSL from the command line in the directory of your choice. After the initial install, the openssl.exe is only available from the directory where it resides, namely:

You could open a command prompt from here and perform the operations you want, but as I am using this to create a Certificate Signing Request (CSR) for a specific purpose, I like to create that from the directory where I’d like to keep that CSR. To do that, lets add it to our PATH, which we can find in the Environment Variables. Here we go:

• Hit the Windows button on your keyboard or click it in the task bar, then search for “Environment Variables”.

How To Install OpenSSL on Windows

OpenSSL is a full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It is licensed under an Apache-style license. This tutorial will help you to install OpenSSL on Windows operating systems.

Step 1 – Download OpenSSL Binary

Download the latest OpenSSL windows installer file from the following download page. Click the below link to visit OpenSSL download page:

Step 2 – Run OpenSSL Installer

Now run the OpenSSL installer on your system. The OpenSSL required Microsoft Visual C++ to be installed on your system. If your system doesn’t have Microsoft Visual C++ installed, the installer will show your message like:

Click Yes to download and install required Microsoft Visual C++ package on your system.

Then again run the OpenSSL installer and follow the wizard.

Step 3 – Setup Environment Variables

Now set the environment variables to function OpenSSL properly on your system. You are required to set OPENSSL_CONF and Path environment variables.

Set OPENSSL_CONF Variable:

Set Path Variable:

Step 4 – Run OpenSSL Binary

Open a command prompt and type openssl to get OpenSSL prompt. Then run version command on OpenSSL proper to view installed OpenSSL version.