> [[email protected] - Fri Sep 25 17:54:07 2009]: > > Hi, > > The following patch adds a new option, '-ext_print' to the x509 > program which prints out the x509v3 extensions included in a > certificate. The use case for this patch is that for users which use > the command line program to parse and analyze certificates, it is > useful to get the raw extensions to evaluate whether the certificate > is correct for it's planned usage. The only way to programmatically do > this without my patch is to print the entire certificate using the > '-text' option then use a scripting tool such as perl or sed/awk to > extract the extensions from the output. >
There is a way to do this using the -certopt option to turn off all options other than extensions as follows: openssl x509 -in ca-cert.pem -text -noout -certopt no_header,no_sigdump,no_version,no_subject,no_issuer,no_validity,no_serial,no_pubkey, no_signame This is of course rather cumbersome and could be made cleaner with something like ext_only. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
