When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other values, like CN=, should be accepted from CSR.
openssl/ca/policy configuration only supports match and supplied options.