Unable to load config info from /usr/local/ssl/openssl.cnf on Windows

Question

While using OpenSSL on Windows:

openssl genrsa -out privatekey.pem 1024 -->

Created successfully

openssl req -new -x509 -key privatekey.pem -out publickey.cer -days 365 
---->

Showing error message as

unable to load config info from /usr/local/ssl/openssl.cnf

All answers show that somehow one must reference the config file openssl.cnf.. BUT nobody mentions what config file,?? who creates it, ?? what is its content? — joedotnot, Mar 19 '19 at 01:54

score 197 · Answer 1 · edited Oct 29 '18 at 15:01

197

After installing OpenSSL I was required to create a new environment variable:

Name: OPENSSL_CONF
Value: C:\Program Files\OpenSSL\openssl.cnf

In powershell:

$env:OPENSSL_CONF = "${env:ProgramFiles}\OpenSSL\openssl.cnf"

This value differs from previous installation versions (as seen in a previous edit of this post). Also, don't forget to add the openssl binary folder ${env:ProgramFiles}\OpenSSL to your Path.

edited Oct 29 '18 at 15:01

mikemaccana

110,530
99
389
494

answered Dec 09 '13 at 04:12

lame_coder

3,085
3
19
21

16

On version 1.0.1j I had to use `C:\OpenSSL-Win32\bin\openssl.cfg` instead. – Kevin Panko Oct 22 '14 at 13:50
8

Or C:\OpenSSL-Win64\bin\openssl.cfg in 64bits systems – borjab Nov 13 '14 at 09:59
14

Or `C:\Program Files (x86)\Git\ssl\openssl.cfg` for those already with git. – kspearrin Dec 30 '15 at 03:43
where/how are you setting this value? – matthew_360 Aug 24 '16 at 16:40
This would put it in your user's startup environment: `SETX OPENSSL_CONF c:/libs/openssl-0.9.8k/openssl.cnf` – Ross Presser Sep 23 '16 at 18:57
On my windows installation the path was "C:\Program Files (x86)\GnuWin32\share\openssl.cnf" – Rafael Araújo Sep 18 '19 at 21:33
to find the path, the best way is to first look for the directory where the openssl binary is stored. To do so, run the following command `(get-command openssl).Path` and then look for the openssl.cnf file within that directory (directly in this folder, or in share/ssl/bin subfolder) – Florent Roques Apr 06 '20 at 23:26
For me, the conf file from Git is at `c:\Program Files\Git\usr\ssl\openssl.cnf` – Hodossy Szabolcs May 12 '20 at 09:54

score 98 · Answer 2 · edited Jan 10 '17 at 03:43

98

You should specify the absolute path to the config, something like this:

openssl req -x509 -config "C:\OpenSSL-Win64\bin\openssl.cnf" ...

edited Jan 10 '17 at 03:43

jww

97,681
90
411
885

answered Oct 16 '13 at 09:47

zombi_man

1,804
3
16
22

37

-config C:\OpenSSL-Win64\bin\openssl.cnf – TimK Oct 22 '13 at 21:28
4

In Version 1.0.1e downloaded from http://slproweb.com/products/Win32OpenSSL.html there is only the file `openssl.cfg` present in the bin directory after installation. But with this file it seems to work anyway. – vanje Dec 05 '13 at 11:28
9

If you're using the OpenSSL provided with Git then you might try `-config "C:\Program Files (x86)\Git\ssl\openssl.cnf"` – Joel B Aug 24 '15 at 01:23
2

openssl:Error: '-config' is an invalid command. how do you guys set it? – benez Dec 17 '15 at 14:01
1

@kewlbfy see @Kosar answer below for where to use the `-config` flag, this worked for me – danjah Aug 15 '16 at 05:19

score 42 · Answer 3 · answered Jul 22 '17 at 06:07

42

In Windows 10, no need to restart nor run in Administrator's mode but instead set openssl config like so:

set OPENSSL_CONF=C:\Program Files (x86)\GnuWin32\share\openssl.cnf

Of course, if you are using GnuWin32

answered Jul 22 '17 at 06:07

BlackPearl

2,532
3
33
49

simhumileco · Answer 4 · 2019-01-09T18:36:01.257

The only thing that worked for me in this situation was the self-created openssl.cnf file.

Here are the basics needed for this exercise (edit as needed):

#
# OpenSSL configuration file.
#

# Establish working directory.

dir                         = .

[ ca ]
default_ca                  = CA_default

[ CA_default ]
serial                      = $dir/serial
database                    = $dir/certindex.txt
new_certs_dir               = $dir/certs
certificate                 = $dir/cacert.pem
private_key                 = $dir/private/cakey.pem
default_days                = 365
default_md                  = md5
preserve                    = no
email_in_dn                 = no
nameopt                     = default_ca
certopt                     = default_ca
policy                      = policy_match

[ policy_match ]
countryName                 = match
stateOrProvinceName         = match
organizationName            = match
organizationalUnitName      = optional
commonName                  = supplied
emailAddress                = optional

[ req ]
default_bits                = 1024          # Size of keys
default_keyfile             = key.pem       # name of generated keys
default_md                  = md5               # message digest algorithm
string_mask                 = nombstr       # permitted characters
distinguished_name          = req_distinguished_name
req_extensions              = v3_req

[ req_distinguished_name ]
# Variable name             Prompt string
#-------------------------    ----------------------------------
0.organizationName          = Organization Name (company)
organizationalUnitName      = Organizational Unit Name (department, division)
emailAddress                = Email Address
emailAddress_max            = 40
localityName                = Locality Name (city, district)
stateOrProvinceName         = State or Province Name (full name)
countryName                 = Country Name (2 letter code)
countryName_min             = 2
countryName_max             = 2
commonName                  = Common Name (hostname, IP, or your name)
commonName_max              = 64

# Default values for the above, for consistency and less typing.
# Variable name             Value
#------------------------     ------------------------------
0.organizationName_default  = My Company
localityName_default        = My Town
stateOrProvinceName_default = State or Providence
countryName_default         = US

[ v3_ca ]
basicConstraints            = CA:TRUE
subjectKeyIdentifier        = hash
authorityKeyIdentifier      = keyid:always,issuer:always

[ v3_req ]
basicConstraints            = CA:FALSE
subjectKeyIdentifier        = hash

I hope that helps.

Having tried every other solution listed here, this one worked for me. Once the config is created (in the openssl.exe directory) you can then run `openssl req -new -x509 -key privatekey.pem -out publickey.cer -days 365 -config openssl.cnf` — Jimbo, Sep 25 '19 at 13:25

mavis · Answer 5 · 2014-11-29T12:10:53.820

In windows , [Similar scenario]

I was facing the same problem But It was during requesting for Certificate Signing Request.

I did the below , It Worked for me.

Once OpenSSL installed, Ran command prompt as administrator after the system reboot.[for the best I did both.. run as admin and system reboot]

did, 1.[Error Case]

C:\OpenSSL-Win64\bin>openssl req -new -key server.key -out server.csr

WARNING: can't open config file: C:\OpenSSL-Win64\bin\openssl.cnf AND Unable to load config info from C:\OpenSSL-Win64\bin\openssl.cnf

2.[Worked with Warning]

C:\OpenSSL-Win64\bin> openssl req -new -key server.key -out server.csr -config C:\OpenSSL-Win64\bin\openssl.cfg

[Warning message]: WARNING: can't open config file: C:\OpenSSL-Win64\bin\openssl.cnf

But prompted me for the Pass Phrase for server.key It worked for me.

I referred,This link for my assistance.

Thank you.

Thanks, the link you provided helped me very much: http://www.akadia.com/services/ssh_test_certificate.html — leole, Jan 23 '17 at 09:22

score 12 · Answer 6 · edited Mar 15 '18 at 22:27

12

After installing OpenSSL, you need to restart your computer and use Run As Administrator. Then its works.

edited Mar 15 '18 at 22:27

Ronan Boiteau

9,608
6
34
56

answered Jan 23 '13 at 12:26

karthik

2,333
2
13
11

score 12 · Answer 7 · answered May 24 '16 at 19:33

12

For me on Windows 8, I simply found openssl.cnf file and copied it on the C drive. then:

openssl req -new -key server.key -out server.csr -config C:\openssl.cnf

Worked perfectly.

answered May 24 '16 at 19:33

Ali

478
4
10

score 11 · Answer 8 · answered Mar 18 '16 at 08:29

11

With the GnuWin32 tools I found the openssl.cnf under C:\gnuwin32\share

set OPENSSL_CONF=C:\gnuwin32\share\openssl.cnf

answered Mar 18 '16 at 08:29

T L

123
1
7

score 6 · Answer 9 · edited Mar 15 '18 at 22:27

6

In Windows 7 I didn't have to restart, simply run command prompt in administrator mode.

edited Mar 15 '18 at 22:27

Ronan Boiteau

9,608
6
34
56

answered Jun 25 '13 at 16:26

Calgary Libertarian

414
5
5

score 6 · Answer 10 · answered Dec 11 '17 at 10:18

In my case, I need to set the path of openssl.cnf file manually on the command using config option. So the command

openssl req -x509 -config "C:\Users\sk\Downloads\openssl-0.9.8k_X64\openssl.cnf" -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 900

score 3 · Answer 11 · answered Jan 14 '18 at 04:53

If you're using Win32 OpenSSL v1.1.0g, setting up this environment variable:

set OPENSSL_CONF=C:\OpenSSL-Win32\bin\cnf\openssl.cnf

Before running this command with "server.key", successfully creating "server.csr":

openssl req -new -key server.key -out server.csr

loveofthecode · Answer 12 · 2019-09-26T20:06:07.400

On the basic question of why openssl is not found: Short answer:Some installation packages for openssl have a default openssl.cnf pre-included. Other packages do not. In the latter case you will include one from the link shown below; You can enter additional user-specifics --DN name,etc-- as needed.

From https://www.openssl.org/docs/manmaster/man5/config.html,I quote directly:

"OPENSSL LIBRARY CONFIGURATION

Applications can automatically configure certain aspects of OpenSSL using the master OpenSSL configuration file, or optionally an alternative configuration file. The openssl utility includes this functionality: any sub command uses the master OpenSSL configuration file unless an option is used in the sub command to use an alternative configuration file.

To enable library configuration the default section needs to contain an appropriate line which points to the main configuration section. The default name is openssl_conf which is used by the openssl utility. Other applications may use an alternative name such as myapplication_conf. All library configuration lines appear in the default section at the start of the configuration file.

The configuration section should consist of a set of name value pairs which contain specific module configuration information. The name represents the name of the configuration module. The meaning of the value is module specific: it may, for example, represent a further configuration section containing configuration module specific information. E.g.:"

So it appears one must self configure openssl.cnf according to your Distinguished Name (DN), along with other entries specific to your use.

Here is the template file from which you can generate openssl.cnf with your specific entries.

One Application actually has a demo installation that includes a demo .cnf file.

Additionally, if you need to programmatically access .cnf files, you can include appropriate headers --openssl/conf.h-- and parse your .cnf files using

CONF_modules_load_file(const char *filename, const char *appname,
                            unsigned long flags);

Here are docs for "CONF_modules_load_file";

Except the dead links ... this answer was great, since it shed a light on the why the file didn't exist *sometimes*. Searching my machine I found several openssl.cnf files which came with other software, e.g. GitHub, VisualStudio etc, and a copy of any of those worked well, but I had to include -config openssl.cnf in my openssl command line as well. Also note, that a (obviously irrelevant) warning "WARNING: can't open config file: /usr/local/ssl/openssl.cnf" appeared, which isn't too surprising on a Windows machine. Nevertheless the certificates were created properly. — Nimral, Dec 14 '21 at 12:32

score 1 · Answer 13 · answered Mar 27 '20 at 15:31

1

On Windows Powershell:

$env:OPENSSL_CONF = "${env:ProgramFiles}\OpenSSL-Win64\bin\openssl.cfg"

answered Mar 27 '20 at 15:31

Edmunds22

715
9
10

score 0 · Answer 14 · edited Oct 21 '16 at 20:09

0

For me put variable before calling did the trick:

OPENSSL_CONF=/usr/ssl/openssl.cnf openssl req -new -x509 -key privatekey.pem -out publickey.cer -days 365

edited Oct 21 '16 at 20:09

Maher Abuthraa

17,493
11
81
103

answered Oct 21 '16 at 19:49

VoloshinS

26
3

ololuki · Answer 15 · 2022-01-06T15:11:41.437

I had similar problem on Windows 7:

WARNING: can't open config file: C:\OpenSSL-Win32\bin\openssl.cfg
Unable to load config info from C:\OpenSSL-Win32\bin\openssl.cfg

The reason was removed OpenSSL-Win32 directory without using deinstallator, so not all components was properly removed from system. I had to remove environment variable OPENSSL_CONF manually.

Some openssl binaries, e.g. installed with git, does not need OPENSSL_CONF environment variable, but if this environment variable exists it must lead to valid file.

Unable to load config info from /usr/local/ssl/openssl.cnf on Windows

15 Answers15

Linked

Related