7

I'm using a Windows Server 2008 R2 domain controller with Active Directory Certificate Services installed. It's configured as an Enterprise Root CA.

I have configured a custom certificate template so that I can generate extended validation SSL certificates from the CA.

In many of the EV SSL certificates, the following OIDs are specified in the "Subject" field of issued certificates:

2.5.4.15 = ORGANIZATION TYPE
1.3.6.1.4.1.311.60.2.1.2 = STATE
1.3.6.1.4.1.311.60.2.1.3 = COUNTRY

For example:
2.5.4.15 = Private Organization
1.3.6.1.4.1.311.60.2.1.2 = Arizona
1.3.6.1.4.1.311.60.2.1.3 = US

I'm trying to see if there is already a place for me to specify these custom OIDs and their values to be used when requesting the certificate through Active Directory from my CA.

I took a look at an EV SSL Hotmail certificate, and its certificate has the OIDs above in its Subject field:

http://yffaz.org/imgs/hotmail.png

If I use the MMC certificate snap-in and select "local computer" and attempt to request a certificate using my custom certificate template using supplied values, I only see the following items, and none where I can specify an OID:

http://yffaz.org/imgs/adcs-request.png

Does anyone have an idea of how I might accomplish this?

4

The command-line certreq tool will allow you to include arbitrary extensions (by OID) in your request but the tool is somewhat less than intuitive to use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.