Richard,
Thank you for your quick reply. The addition of the attributes to the
certificate does not need to take place in the signing request. In
fact, it should actually take place when the CSR is turned into a
certificate. Is there a way (using OpenSSL 0.9.6c) for the CA to add
extensions to the certificate at the time that it is signed?
I have added "custom" OIDs to the configuration file, and have created a
section called [ extensions ] in which I list the new objects, but when
I call:
openssl ca -keyfile cakey.pem -in csr.pem \
-extensions extensions -out crt.pem
I receive an error that reads:
Error Loading extension section extensions
903:error:2207C081:X509 V3 routines:DO_EXT_CONF:unknown
extension:v3_conf.c:125:
903:error:2206B080:X509 V3 routines:X509V3_EXT_conf:error in
extension:v3_conf.c:91:name=MyAttribute, value=MyValue
Is there something else I must do before I can use these attributes in
an extensions section?
Thanks again for your help,
~brian skrab
[EMAIL PROTECTED]
Richard Levitte - VMS Whacker wrote:
> In message <[EMAIL PROTECTED]> on Thu, 11 Apr 2002 19:10:00 +0500, Brian
>Skrab <[EMAIL PROTECTED]> said:
>
> brian.skrab> openssl x509 -noout -text -in crt.pem
> brian.skrab>
> brian.skrab> does not display the attributes as they were shown in the CSR.
> brian.skrab>
> brian.skrab> Any hints, pointers, or (dare I dream to be so lucky)
> brian.skrab> sample code will be much appreciated.
>
> In http://www.openssl.org/docs/apps/ca.html, read up on the
> configuration setting "copy_extensions".
>
> Note: that feature is very new, as far as I remember only available in
> 0.9.7-dev.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
