if I rework this to an 'ext-only' option, would this be acceptable? I would prefer to improve the usability.
On 9/25/09, Stephen Henson via RT <[email protected]> wrote: >> [[email protected] - Fri Sep 25 17:54:07 2009]: >> >> Hi, >> >> The following patch adds a new option, '-ext_print' to the x509 >> program which prints out the x509v3 extensions included in a >> certificate. The use case for this patch is that for users which use >> the command line program to parse and analyze certificates, it is >> useful to get the raw extensions to evaluate whether the certificate >> is correct for it's planned usage. The only way to programmatically do >> this without my patch is to print the entire certificate using the >> '-text' option then use a scripting tool such as perl or sed/awk to >> extract the extensions from the output. >> > > There is a way to do this using the -certopt option to turn off all > options other than extensions as follows: > > openssl x509 -in ca-cert.pem -text -noout -certopt > no_header,no_sigdump,no_version,no_subject,no_issuer,no_validity,no_serial,no_pubkey, > no_signame > > This is of course rather cumbersome and could be made cleaner with > something like ext_only. > > Steve. > -- > Dr Stephen N. Henson. OpenSSL project core developer. > Commercial tech support now available see: http://www.openssl.org > > ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
