After a little more experimentation to figure out why this suddenly started working, I uncovered my mistake: I was missing the emailAddress field in the policy section for the CA command. Since I did not want the emailAddress in the DN, I removed this from the policy, which broke the email:move directive. It appears that the email:move takes place AFTER the policy is evaluated and the cert. DN is built. So that even though "emailAddress" appears in the CA policy, it will NOT appear in the DN if the subjectAltName=email:move is in force.
Sorry for the list noise, but this does seem a bit obscure. Perhaps even obtuse. :)
On a related note, how does this work for the other types of general names (e.g. DNS, IP)? Looking through the v3_alt.c I don't see any code that moves or copies DNS or IP values from the DN into alternative names extensions. Do all these other general names types need to be hard-coded in the config? (or at least hard-coded into the extensions file?)
On Nov 21, 2003, at 4:51 PM, Dr. Stephen Henson wrote:
On Sat, Nov 22, 2003, Dr. Stephen Henson wrote:
On Sat, Nov 22, 2003, Dr. Stephen Henson wrote:
On Fri, Nov 21, 2003, Joseph Bruni wrote:
I've been poking around in the v3_alt.c file to try to determine why the email address is not getting copied or moved into the extension. After sprinkling in a few debug statements, it looks like the copy_email() function is broken and never enters the "while" loop. Even though the DN has an 'emailAddress' field, this function is unable to locate it, and no value is getting copied into the v3 extensions.
This function is only called in response to an email:move or and email:copy directive. If this function is broken, it would explain why hard-coding in an email address works whereas the copy/move directives do not.
I will continue to analyze this function to determine why it's not working. I post this with the hope that someone more familiar with it can reach a solution faster than I can.
OK, someone's woke me up now. I'll look at it :-)
I've just tried this against OpenSSL 0.9.7c and it seems to work fine.
Could you send me your openssl.cnf and tell me the exact commands you are using
to get this behaviour?
Oh and which version of OpenSSL are you using?
Steve. -- Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage OpenSSL project core developer and freelance consultant. Funding needed! Details on homepage. Homepage: http://www.drh-consultancy.demon.co.uk ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
