Gregor Leander wrote:
>
> Hi,
>
> I am trying to create a user certificate with OpenSSL.
> The problem is that I need one name attribute (for example: OU) two
> times. That was no problem, when I used the "nomal" request type, but I
> need to create Certificates with the "-spkac" option, because I want to
> use the possibility to request certificates using the Netscape Browser.
> My question is now, is it possible to create a certificate with two name
> attributes of the same type using the SPKAC option, and if it is, what
> do I have to do to get it running.
>
> I uesd the following input for the -spkac option:
>
> emailAddress [EMAIL PROTECTED]
> commonName =Gregor Leander
> organizationUnit =XYZ
> organizationUnit =ABC
> SPKAC =MIG0MGA.... the Public Key ....
>
> but in the DN of the certificate there was only one OrganizationUnit
> entry (it was ABC), so to me it seems to be like the first entry was
> replaced by the second one, instead of added as a new entry.
>
You can't include the same attribute twice because the config file
library can't see them both.
The alternative is to use the same form that 'req' uses:
XXX.organizationUnit
YYY.organizationUnit
For example:
1.organizationUnit=OU name 1
2.organizationUnit=OU name 2
This functionality has been added since OpenSSL 0.9.4 so you'll need the
latest snapshot.
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
