- Unix, Linux Command

If the -key option is not used it will generate a new RSA private
key using information specified in the configuration file.



/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe



If -multi-rdn is not used then the UID value is 123456+CN=John Doe.



More precisely the Attributes in a PKCS#10 certificate request
are defined as a SET OF Attribute. They are not OPTIONAL so
if no attributes are present then they should be encoded as an
empty SET OF. The invalid form does not include the empty
SET OF whereas the correct form does.



It should be noted that very few CAs still require the use of this option.


The options available are described in detail below.



It can be set to several values default which is also the default
option uses PrintableStrings, T61Strings and BMPStrings if the
pkix value is used then only PrintableStrings and BMPStrings will
be used. This follows the PKIX recommendation in RFC2459. If the
utf8only option is used then only UTF8Strings will be used: this
is the PKIX recommendation in RFC2459 after 2003. Finally the nombstr
option just uses PrintableStrings and T61Strings: certain software has
problems with BMPStrings and UTF8Strings: in particular Netscape.




 CN=My Name
 OU=My Organization
 emailAddress=someone@somewhere.org


This allows external programs (e.g. GUI based) to generate a template file
with all the field names and values and just pass it to req. An example
of this kind of configuration file is contained in the EXAMPLES section.


Alternatively if the prompt option is absent or not set to no then the
file contains field prompting information. It consists of lines of the form:




 fieldName="prompt"
 fieldName_default="default field value"
 fieldName_min= 2
 fieldName_max= 4


fieldName is the field name being used, for example commonName (or CN).
The prompt string is used to ask the user to enter the relevant
details. If the user enters nothing then the default value is used if no
default value is present then the field is omitted. A field can
still be omitted if a default value is present if the user just
enters the ’.’ character.


The number of characters entered must be between the fieldName_min and
fieldName_max limits: there may be additional restrictions based
on the field being used (for example countryName can only ever be
two characters long and must fit in a PrintableString).


Some fields (such as organizationName) can be used more than once
in a DN. This presents a problem because configuration files will
not recognize the same name occurring twice. To avoid this problem
if the fieldName contains some characters followed by a full stop
they will be ignored. So for example a second organizationName can
be input by calling it 1.organizationName.


The actual permitted field names are any object identifier short or
long names. These are compiled into OpenSSL and include the usual
values such as commonName, countryName, localityName, organizationName,
organizationUnitName, stateOrProvinceName. Additionally emailAddress
is include as well as name, surname, givenName initials and dnQualifier.


Additional object identifiers can be defined with the oid_file or
oid_section options in the configuration file. Any additional fields
will be treated as though they were a DirectoryString.




 openssl req -in req.pem -text -verify -noout


Create a private key and then generate a certificate request from it:




 openssl genrsa -out key.pem 1024
 openssl req -new -key key.pem -out req.pem


The same but just using req:




 openssl req -newkey rsa:1024 -keyout key.pem -out req.pem


Generate a self signed root certificate:




 openssl req -x509 -newkey rsa:1024 -keyout key.pem -out req.pem


Example of a file pointed to by the oid_file option:




 1.2.3.4        shortName       A longer Name
 1.2.3.6        otherName       Other longer Name


Example of a section pointed to by oid_section making use of variable
expansion:




 testoid1=1.2.3.5
 testoid2=${testoid1}.6


Sample configuration file prompting for field values:




 [ req ]
 default_bits           = 1024
 default_keyfile        = privkey.pem
 distinguished_name     = req_distinguished_name
 attributes             = req_attributes
 x509_extensions        = v3_ca




 dirstring_type = nobmp




 [ req_distinguished_name ]
 countryName                    = Country Name (2 letter code)
 countryName_default            = AU
 countryName_min                = 2
 countryName_max                = 2




 localityName                   = Locality Name (eg, city)




 organizationalUnitName         = Organizational Unit Name (eg, section)




 commonName                     = Common Name (eg, YOUR name)
 commonName_max                 = 64




 emailAddress                   = Email Address
 emailAddress_max               = 40




 [ req_attributes ]
 challengePassword              = A challenge password
 challengePassword_min          = 4
 challengePassword_max          = 20




 [ v3_ca ]




 subjectKeyIdentifier=hash
 authorityKeyIdentifier=keyid:always,issuer:always
 basicConstraints = CA:true


Sample configuration containing all field values:




 RANDFILE               = $ENV::HOME/.rnd




 [ req ]
 default_bits           = 1024
 default_keyfile        = keyfile.pem
 distinguished_name     = req_distinguished_name
 attributes             = req_attributes
 prompt                 = no
 output_password        = mypass




 [ req_distinguished_name ]
 C                      = GB
 ST                     = Test State or Province
 L                      = Test Locality
 O                      = Organization Name
 OU                     = Organizational Unit Name
 CN                     = Common Name
 emailAddress           = test@email.address




 [ req_attributes ]
 challengePassword              = A challenge password




 -----BEGIN CERTIFICATE REQUEST-----
 -----END CERTIFICATE REQUEST-----


some software (some versions of Netscape certificate server) instead needs:




 -----BEGIN NEW CERTIFICATE REQUEST-----
 -----END NEW CERTIFICATE REQUEST-----


which is produced with the -newhdr option but is otherwise compatible.
Either form is accepted transparently on input.


The certificate requests generated by Xenroll with MSIE have extensions
added. It includes the keyUsage extension which determines the type of
key (signature only or general purpose) and any additional OIDs entered
by the script in an extendedKeyUsage extension.




        Using configuration from /some/path/openssl.cnf
        Unable to load config info


This is followed some time later by...




        unable to find ’distinguished_name’ in config
        problems making Certificate Request


The first error message is the clue: it can’t find the configuration
file! Certain operations (like examining a certificate request) don’t
need a configuration file so its use isn’t enforced. Generation of
certificates or requests however does need a configuration file. This
could be regarded as a bug.


Another puzzling message is this:




        Attributes:
            a0:00


this is displayed when no attributes are present and the request includes
the correct empty SET OF structure (the DER encoding of which is 0xa0
0x00). If you just see:




        Attributes:


then the SET OF is missing and the encoding is technically invalid (but
it is tolerated). See the description of the command line option -asn1-kludge
for more information.


As a consequence of the T61String handling the only correct way to represent
accented characters in OpenSSL is to use a BMPString: unfortunately Netscape
currently chokes on these. If you have to use accented characters with Netscape
and MSIE then you currently need to use the invalid T61String form.


The current prompting is not very friendly. It doesn’t allow you to confirm what
you’ve just entered. Other things like extensions in certificate requests are
statically defined in the configuration file. Some of these: like an email
address in subjectAltName should be input by the user.


Advertisements


    129 Lectures 
     23 hours 

 Eduonix Learning Solutions

    5 Lectures 
     4.5 hours 

 Frahaan Hussain

    35 Lectures 
     2 hours 

 Pradeep D

    41 Lectures 
     2.5 hours 

 Musab Zayadneh

    46 Lectures 
     4 hours 

 GUHARAJANM

    6 Lectures 
     4 hours 

 Uplatz
 Print
 Add Notes
 Bookmark this page