On Wednesday 04 Jan 2012 12:33:06 you wrote: > Hi, > > I have some firewalls that puts an subjectAltName X509v3 attribute > into the CSR, but when I sign them with my openssl CA, it just throws > that attribute away. VPN clients later requires the subjectAltName to > match the host it connects to, hence it must be present.
Theoretically at least the VPN client would search the Subject: string for a Distinguished Name. If it can't find it there it will look at the subjAltName which as you say is not always available in a certificate. > I've found many articles how I can add that attribute by using a > custom config file and the -extfile <file> and -extensions <section> > parameters. I've used that as a "work around" to get subjectAltName > into certificates, but it would be better if I could just sign CSRs > and use subjectAltName already specified there. What you can do is set the parameter: # Extension copying option: use with caution. copy_extensions = copy under your CA_default section in your openssl.cnf > Are there any security reasons as to why "openssl x509 -req" strips > the attributes or how can I make a custom config file that let's me > use the X509v3 extended attributes exactly as they are in the CSR? In the sense that you may not know who's created the CSR or what they've allowed in it (the whole signing process can be automated), a copy by default option would seem a bit loose. However, I better leave the openssl devs or someone more knowledgeable to comment on this. -- Regards, Mick
signature.asc
Description: This is a digitally signed message part.
