On Tue, Feb 18, 2003, Thomas Anders wrote: > Dr. Stephen Henson wrote: > >subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:principal_seq > > > >also I've now added GeneralString to the mini ASN1 compiler. > > Once the proper subjectAltName is constructed, is/will there be > a way to get sth. more meaningful than > > X509v3 Subject Alternative Name: > othername:<unsupported> > > from "openssl x509 -noout -text ..." (latest snapshot)? >
This is tricky. It will need some fairly major changes to the way extensions are printed to handle this case. At best it will just print out the asn1parsed result for non supported extensions. > How can I print out the DER value (in hex) that can later be > used in openssl.cnf (subjectAltName=DER:...) to put the > same extension into new certificates? > > You don't need to do that with OpenSSL 0.9.8. If you need compatiblity with earlier versions of OpenSSL and the DER option then you need to extract the raw encoding of the extension. Start with: openssl asn1parse -in cert.pem look for an OBJECT with subject alternative name in it. Then look for an OCTET STRING immediately after it, note the number at the start of that line. Then do: openssl asn1parse -in cert.pem -strparse <number> -out ext.der this text form BTW is the kind of thing OpenSSL might be able to do for unsupported otherName extensions. This will put the binary form of the extension in "ext.der". You now need to convert it to hex and put the result after DER: in the openssl config file. The Unix utility xxd with the -p option does a good job of this. Steve. -- Dr Stephen N. Henson. Core developer of the OpenSSL project: http://www.openssl.org/ Freelance consultant see: http://www.drh-consultancy.demon.co.uk/ Email: [EMAIL PROTECTED], PGP key: via homepage. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
