Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other values, like CN=, should be accepted from CSR.

openssl/ca/policy configuration only supports match and supplied options.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

There isn't a way to override a field from the CSR using the OpenSSL configuration file. The configuration file can only supply default values. There are two options that I can see:

  1. If you're using the openssl ca command to sign a CSR, you can override the subject from the CSR using the -subject argument. So, get the subject from the CSR (openssl req -noout -subject -in req.pem), search-and-replace the fields you want to change, and specify the altered subject on the command line with -subject.
  2. If the static fields that you want are always going to have the same value, you could build your CA certificate so that your policy configuration can specify match for the static fields, i.e. your CA certificate contains the static values in its own fields (e.g. O, OU).
share|improve this answer
    
Thanks for 1), it didn't came to my mind. I want to fill in the fields from some database. Your tip can be used to do that. –  mighq Jan 13 at 16:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.