Hi, I never got a reply but was wondering if my patch below was accepted. I didn't see any further discussion on the mail list archives other than 1 reply and that reply was for a suggested change in the option's name.
Thanks, Walter On Fri, Sep 25, 2009 at 12:02 PM, Walter Goulet <[email protected]> wrote: > if I rework this to an 'ext-only' option, would this be acceptable? I > would prefer to improve the usability. > > On 9/25/09, Stephen Henson via RT <[email protected]> wrote: > >> [[email protected] - Fri Sep 25 17:54:07 2009]: > >> > >> Hi, > >> > >> The following patch adds a new option, '-ext_print' to the x509 > >> program which prints out the x509v3 extensions included in a > >> certificate. The use case for this patch is that for users which use > >> the command line program to parse and analyze certificates, it is > >> useful to get the raw extensions to evaluate whether the certificate > >> is correct for it's planned usage. The only way to programmatically do > >> this without my patch is to print the entire certificate using the > >> '-text' option then use a scripting tool such as perl or sed/awk to > >> extract the extensions from the output. > >> > > > > There is a way to do this using the -certopt option to turn off all > > options other than extensions as follows: > > > > openssl x509 -in ca-cert.pem -text -noout -certopt > > > no_header,no_sigdump,no_version,no_subject,no_issuer,no_validity,no_serial,no_pubkey, > > no_signame > > > > This is of course rather cumbersome and could be made cleaner with > > something like ext_only. > > > > Steve. > > -- > > Dr Stephen N. Henson. OpenSSL project core developer. > > Commercial tech support now available see: http://www.openssl.org > > > > >Hi,
I never got a reply but was wondering if my patch below was accepted. I didn't see any further discussion on the mail list archives other than 1 reply and that reply was for a suggested change in the option's name.
Thanks,
Walter
On Fri, Sep 25, 2009 at 12:02 PM, Walter Goulet <[email protected]> wrote:
if I rework this to an 'ext-only' option, would this be acceptable? I
would prefer to improve the usability.
On 9/25/09, Stephen Henson via RT <[email protected]> wrote:
>> [[email protected] - Fri Sep 25 17:54:07 2009]:
>>
>> Hi,
>>
>> The following patch adds a new option, '-ext_print' to the x509
>> program which prints out the x509v3 extensions included in a
>> certificate. The use case for this patch is that for users which use
>> the command line program to parse and analyze certificates, it is
>> useful to get the raw extensions to evaluate whether the certificate
>> is correct for it's planned usage. The only way to programmatically do
>> this without my patch is to print the entire certificate using the
>> '-text' option then use a scripting tool such as perl or sed/awk to
>> extract the extensions from the output.
>>
>
> There is a way to do this using the -certopt option to turn off all
> options other than extensions as follows:
>
> openssl x509 -in ca-cert.pem -text -noout -certopt
> no_header,no_sigdump,no_version,no_subject,no_issuer,no_validity,no_serial,no_pubkey,
> no_signame
>
> This is of course rather cumbersome and could be made cleaner with
> something like ext_only.
>
> Steve.
> --
> Dr Stephen N. Henson. OpenSSL project core developer.
> Commercial tech support now available see: http://www.openssl.org
>
>
