title: How to determine the default location for openssl.cnf?
body: <h1>Background</h1>
  
  <p>I'm writing a bash script that will use openssl to generate a certificate signing request with <em>X509v3 extension compliant</em> subject alternative names.</p>
  
  <p>Since there's no command line option for this, <a href="http://blog.endpoint.com/2014/10/openssl-csr-with-alternative-names-one.html?m=1#c5955230974051418639" rel="noreferrer">a solution</a> has been to use the <code>-config</code> option in conjunction with the <code>-reqexts</code> option by appending the SAN values inline to the default configuration file.</p>
  
  <pre><code>openssl req -new -sha256 -key domain.key -subj "/C=US/ST=CA/O=Acme, Inc./CN=example.com" -reqexts SAN -config &lt;(cat /etc/ssl/openssl.cnf &lt;(printf "[SAN]\nsubjectAltName=DNS:example.com,DNS:www.example.com")) -out domain.csr
  </code></pre>
  
  <h1>Question</h1>
  
  <p>My problem is portability. While <a href="https://stackoverflow.com/questions/21477210/correct-location-of-openssl-cnf-file">a similar question</a> assures me that this works in my Ubuntu environment because the default configuration file is <code>/etc/ssl/openssl.cnf</code>, unfortunately this won't work everywhere, with Windows being the obvious example.</p>
  
  <p><em>How do I <strong>programmatically</strong> determine the full path to the openssl <strong>default</strong> configuration file?</em></p>
  
  <h1>What I've Tried</h1>
  
  <p>There's a glaring hint in the <a href="https://www.openssl.org/docs/man1.1.0/apps/req.html" rel="noreferrer">documentation</a></p>
  
  <blockquote>
    <p>-config filename<br>
    this allows an alternative configuration file to be specified, this overrides <strong>the compile time filename</strong> or any specified in the OPENSSL_CONF environment variable.</p>
  </blockquote>
  
  <p>I've read the <a href="https://www.openssl.org/docs/man1.1.0/apps/config.html" rel="noreferrer">config documentation</a> and searched the <a href="https://github.com/openssl/openssl" rel="noreferrer">source code</a>, but I can't discover the mechanism by which it chooses from where to load the "compile time" default config file. If I could find that, then I would prefer to load it as a variable into the script instead of the hard-coded path.</p>
  
  <p>Moreover, my <code>$OPENSSL_CONF</code> variable is empty.</p>
  
  <h2>A Bad Alternative</h2>
  
  <p>Currently my script checks these conditions, and uses the first one that evaluates to true:</p>
  
  <ol>
  <li><code>$OPENSSL_CONF</code> variable is populated, and file exists</li>
  <li><code>/etc/ssl/openssl.cnf</code> exists</li>
  </ol>
  
  <p>If neither of those are true, then it includes a copy of a standard configuration. This is undesirable because it would in effect override custom settings established by the client. I want to use the environment's conditions completely, and simply add the SAN section as an addendum.</p>
  
  <p>I could further extend this chain with the paths of the usual suspects or even a system search. But in the event that multiple exist, then I have no assurance of which is in fact used by openssl as a default.</p>