How about something like '-certopt none,ext'? I'd like to see an option where 'none' automatically says 'no_header, no_sigdump, no_version, no_subject, no_issuer, no_validity, no_serial, no_pubkey, no_signame, no_ext', and anything after it is used to add to the set... rather like how ciphers are specified in the cipher string.
-Kyle H On Fri, Sep 25, 2009 at 11:02 AM, Walter Goulet via RT <[email protected]> wrote: > if I rework this to an 'ext-only' option, would this be acceptable? I > would prefer to improve the usability. > > On 9/25/09, Stephen Henson via RT <[email protected]> wrote: >>> [[email protected] - Fri Sep 25 17:54:07 2009]: >>> >>> Hi, >>> >>> The following patch adds a new option, '-ext_print' to the x509 >>> program which prints out the x509v3 extensions included in a >>> certificate. The use case for this patch is that for users which use >>> the command line program to parse and analyze certificates, it is >>> useful to get the raw extensions to evaluate whether the certificate >>> is correct for it's planned usage. The only way to programmatically do >>> this without my patch is to print the entire certificate using the >>> '-text' option then use a scripting tool such as perl or sed/awk to >>> extract the extensions from the output. >>> >> >> There is a way to do this using the -certopt option to turn off all >> options other than extensions as follows: >> >> openssl x509 -in ca-cert.pem -text -noout -certopt >> no_header,no_sigdump,no_version,no_subject,no_issuer,no_validity,no_serial,no_pubkey, >> no_signame >> >> This is of course rather cumbersome and could be made cleaner with >> something like ext_only. >> >> Steve. >> -- >> Dr Stephen N. Henson. OpenSSL project core developer. >> Commercial tech support now available see: http://www.openssl.org >> >> > > > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > Development Mailing List [email protected] > Automated List Manager [email protected] > ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
