Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other values, like CN=, should be accepted from CSR.

openssl/ca/policy configuration only supports match and supplied options.

share|improve this question
up vote 2 down vote accepted

There isn't a way to override a field from the CSR using the OpenSSL configuration file. The configuration file can only supply default values. There are two options that I can see:

  1. If you're using the openssl ca command to sign a CSR, you can override the subject from the CSR using the -subject argument. So, get the subject from the CSR (openssl req -noout -subject -in req.pem), search-and-replace the fields you want to change, and specify the altered subject on the command line with -subject.
  2. If the static fields that you want are always going to have the same value, you could build your CA certificate so that your policy configuration can specify match for the static fields, i.e. your CA certificate contains the static values in its own fields (e.g. O, OU).
share|improve this answer
Thanks for 1), it didn't came to my mind. I want to fill in the fields from some database. Your tip can be used to do that. – mighq Jan 13 '15 at 16:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.