Bash 脚本带有“openssl req -new -key server.key -out server.csr -config server_openssl.cnf --passin pass:password”

我正在编写一个 bash 脚本，它将生成一个根证书和一个服务器证书。根证书生成成功，但服务器证书提示我输入 - 但是由于这是一个 bash 脚本，它应该只使用配置中的值。

rootCA_openssl.cnf

[ req ]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
 
[ req_distinguished_name ]
countryName = NO
countryName_default = NO
stateOrProvinceName = Nordland
stateOrProvinceName_default = Nordland
organizationName = Lumina Ventures
organizationName_default = Lumina Ventures
commonName = Lumina Ventures Root CA 1
commonName_default = Lumina Ventures CA 1
 
[ v3_req ]
basicConstraints = CA:true
keyUsage = critical, keyCertSign

根尔萨

openssl genrsa -aes256 -out rootCA.key --passout pass:password 2048

为根 CA 证书创建 CSR（证书签名请求）文件

openssl req -new -key rootCA.key -out rootCA.csr -config rootCA_openssl.cnf --passin pass:password

生成根CA证书文件rootCA.pem

openssl x509 -req -in rootCA.csr -sha512 -signkey rootCA.key -out rootCA.pem -days 1095 -extensions v3_req -extfile rootCA_openssl.cnf --passin pass:password

服务器_openssl.cnf

[ req ]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no

[ req_distinguished_name ]
countryName = NO
countryName_default = NO
stateOrProvinceName = Nordland
stateOrProvinceName_default = Nordland
localityName = Lofoten
localityName_default = Lofoten
organizationName = Lumina Ventures
organizationName_default = Lumina Ventures
commonName = 80.50.50.20
commonName_default = 80.50.50.20
commonName_max = 64
 
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
 
[ alt_names ]
IP.1 = 80.50.50.20

出现提示时输入密码

openssl genrsa -aes256 -out server.key --passout pass:password 2048

req（到此停止）

openssl req -new -key server.key -out server.csr -config server_openssl.cnf --passin pass:password

这促使我：

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
NO [NO]:

如何在服务器配置中使用默认值？我尝试将其添加prompt = no到该[ req ]部分，但它给出了一个新的错误：

Error making certificate request
4057E170FB7C0000:error:04000067:object identifier routines:OBJ_txt2obj:unknown object name:../crypto/objects/obj_dat.c:376:
4057E170FB7C0000:error:05800077:x509 certificate routines:X509_NAME_ENTRY_create_by_txt:invalid field name:../crypto/x509/x509name.c:252:name=countryName_default

我要做的最后一件事是生成证书，但是我被困在 openssl req

openssl x509 -req -in server.csr -sha256 -CA rootCA.pem -CAkey rootCA.key -out server.pem -days 1095 -extensions v3_req -extfile server_openssl.cnf