Hi all,
I have generated KDC certificate using openssl for PKINIT
implementation. Following lines were included in openssl.cnf while
generating KDC certificate containing Subject Alternative Extension.
# Add id-pkinit-san (pkinit subjectAlternativeName)
subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:kdc_princ_name
[kdc_princ_name]
realm = EXP:0, GeneralString:${ENV::REALM}
principal_name = EXP:1, SEQUENCE:kdc_principal_seq
[kdc_principal_seq]
name_type = EXP:0, INTEGER:1
name_string = EXP:1, SEQUENCE:kdc_principals
[kdc_principals]
princ1 = GeneralString:krbtgt
princ2 = GeneralString:${ENV::REALM}
But when i tried to view the contents of KDC certificate using following
command:
*openssl asn1parse -in KDC.cert.pem, *it looked as shown below*
*
690:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Issuer Alternative Name
695:d=5 hl=2 l= 2 prim: OCTET STRING [HEX DUMP]:3000
699:d=4 hl=2 l= 102 cons: SEQUENCE
701:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Subject Alternative Name
706:d=5 hl=2 l= 95 prim: OCTET STRING [HEX
DUMP]:305DA05B06062B0601050202A051304FA0141B12474C4F42414C45444745534F46542E434F4DA1373035A003020102A12E302C1B166B64632E676C6F62616C65646765736F66742E636F6D1B12474C4F42414C45444745534F46542E434F4D
803:d=1 hl=2 l= 13 cons: SEQUENCE
I tried asn1parse -strparse also:
*openssl asn1parse -strparse 706 -in KDC.cert.pem, *it looked as shown below
*
*0:d=0 hl=2 l= 93 cons: SEQUENCE
2:d=1 hl=2 l= 91 cons: cont [ 0 ]
4:d=2 hl=2 l= 6 prim: OBJECT :1.3.6.1.5.2.2
12:d=2 hl=2 l= 81 cons: cont [ 0 ]
14:d=3 hl=2 l= 79 cons: SEQUENCE
16:d=4 hl=2 l= 20 cons: cont [ 0 ]
18:d=5 hl=2 l= 18 prim: GENERALSTRING
38:d=4 hl=2 l= 55 cons: cont [ 1 ]
40:d=5 hl=2 l= 53 cons: SEQUENCE
42:d=6 hl=2 l= 3 cons: cont [ 0 ]
44:d=7 hl=2 l= 1 prim: INTEGER :02
47:d=6 hl=2 l= 46 cons: cont [ 1 ]
49:d=7 hl=2 l= 44 cons: SEQUENCE
51:d=8 hl=2 l= 22 prim: GENERALSTRING
75:d=8 hl=2 l= 18 prim: GENERALSTRING*
*My queries are:
a) Whether the lines (above mentioned) included in openssl.cnf for adding
Subject Alternative name in KDC certificate are correct?
b) Does Subject Alternative Extension included in KDC certificate(By adding
above mentioned lines in openssl.cnf) contains REALM name and kdc principal
name?
c) What is the openssl command to view the contents of Subject Alternative Name
extension(Printable form) in KDC certificate at konsole as the above mentioned
openssl commands(
*openssl asn1parse -in KDC.cert.pem, openssl asn1parse -strparse 706 -in
KDC.cert.pem*) prints the SAN contents in hex form?
Please guide me.
Regards,
Vinay
________________________________________________
Kerberos mailing list [email protected]
https://mailman.mit.edu/mailman/listinfo/kerberos
