Third issue is how to print certificate subject/issuer distinguished name in UTF-8 in more user friendly way ?
Example from manual page work fine: $ openssl x509 -in cert.pem -noout -subject -nameopt oneline,-esc_msb I prefer to use command more compatible to so called compatible format: $ openssl x509 -in cert.pem -noout -subject -nameopt oneline,-esc_msb,-space_eq,sep_comma_plus Bot above commands are not so intuitive. After reading documentation user may try: $ openssl x509 -in testid_rsa-rsa_md5.crt -noout -subject -nameopt utf8 This command show noting, without no error message and exit status is zero. The documentation don't advice user that field separators are mandatory. One solution is a_strex.c function "do_name_ex" to use as default one of existing formats. Other possible solution is to add new "-nameopt" option, as example UTF8 equivalent to utf8, one of field separators and etc or maybe just to "oneline" but without "esc_msb". Third solution is to change only documentation to clarify that field separators are mandatory. No idea what to prefer. Fourth issue is related to "-nameopt" "group" options. One group of options are field separators(sep_comma_plus, sep_comma_plus_space, sep_semi_plus_space, sep_multiline). Other group are options for field names (nofname, sname, lname, oid). Flags for these options are more like value. They are not based on bits. Quote from documentation "Each option is described in detail below, all options can be preceded by a - to turn the option off." This is not valid for these groups of options. The minus before these options is useless. The program code "surprisingly" :) work although performed bitwise operation in that case. Roumen ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
