When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other values, like CN=, should be accepted from CSR.

openssl/ca/policy configuration only supports match and supplied options.


There isn't a way to override a field from the CSR using the OpenSSL configuration file. The configuration file can only supply default values. There are two options that I can see:

  1. If you're using the openssl ca command to sign a CSR, you can override the subject from the CSR using the -subject argument. So, get the subject from the CSR (openssl req -noout -subject -in req.pem), search-and-replace the fields you want to change, and specify the altered subject on the command line with -subject.
  2. If the static fields that you want are always going to have the same value, you could build your CA certificate so that your policy configuration can specify match for the static fields, i.e. your CA certificate contains the static values in its own fields (e.g. O, OU).
  • 1
    Thanks for 1), it didn't came to my mind. I want to fill in the fields from some database. Your tip can be used to do that. – mighq Jan 13 '15 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.