Which of the following openssl commands generates a certificate signing request (CSR) using the already existing private key contained in the file private/ keypair.pem?

Question

Options

• Aopenssl req -key private/keypair.pem -out req/csr.pem
• Bopenssl req - new -key private/keypair.pem -out req/csr.pem
• Copenssl gencsr -key private/keypair.pem -out req/csr.pem
• Dopenssl gencsr -new- key private/keypair.pem -out req/csr.pem

• B
  95% (20)
• D
  5% (1)

Explanation

Option B is correct because generating a new CSR with openssl req requires the -new flag to signal that a fresh request should be created, combined with -key to reference the existing private key file and -out to specify the output file. Option A is wrong because it omits -new, so openssl req without that flag expects to read and display an existing CSR rather than generate one. Options C and D are wrong because openssl gencsr is not a valid subcommand - OpenSSL uses req for CSR operations, not gencsr; D also has a malformed flag (-new- key instead of -new -key).

Memory tip: Think of -new as telling OpenSSL "make me something new" - without it, req is in read mode, not create mode. The pattern openssl req -new -key <private_key> -out <csr> is the canonical CSR generation command worth memorizing verbatim.

No community discussion yet for this question.