> On Dec 23, 2018, at 10:21 AM, Michael Richardson <mcr@xxxxxxxxxxxx> wrote:
>
> It seems that the "openssl ca" mechanism still seem to want a subjectDN
> defined. Am I missing some mechanism that would let me omit all of that? Or
> is a patch needed to kill what seems like a current operational requirement?
It is not a matter of "openssl ca". An X.509 certificate has a subjectDN,
that's a required part of the certificate structure. However, a "DN" is a
SEQUENCE of "RDNs", and that sequence can be empty, for example (requires "bash"):
$ openssl req -config <(
printf "%s\n[dn]\n%s\n[ext]\n%s\n" \
"distinguished_name = dn" \
"prompt = yes" \
"$(printf "subjectAltName = DNS:%s\n" "example.com")"
) \
-extensions ext -new -newkey rsa:1024 -nodes -keyout /dev/null \
-x509 -subj / 2>/dev/null |
openssl x509 -noout -text -certopt no_pubkey,no_sigdump
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
47:37:cb:39:a4:9c:be:c2:ea:42:2f:ed:e2:df:bc:62:bb:2b:cb:dd
Signature Algorithm: sha256WithRSAEncryption
Issuer:
Validity
Not Before: Dec 23 18:56:08 2018 GMT
Not After : Jan 22 18:56:08 2019 GMT
Subject:
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:example.com
Note the empty subjectDN and issuerDN. The latter violates RFC5280, but
will suffice for this example. An RFC compliant *self-signed* certificate
needs to have a non-empty issuer name, so it could be something like:
$ openssl req -config <(
printf "%s\n[dn]\n%s\n[ext]\n%s\n" \
"distinguished_name = dn" \
"prompt = yes" \
"$(printf "subjectAltName = DNS:%s\n" "example.com")"
) \
-extensions ext -new -newkey rsa:1024 -nodes -keyout /dev/null \
-x509 -subj "/O=Self" 2>/dev/null |
openssl x509 -noout -text -certopt no_pubkey,no_sigdump
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
6b:f0:9e:6c:ff:27:f3:cb:eb:79:10:6d:ac:9a:c2:54:e4:78:06:b0
Signature Algorithm: sha256WithRSAEncryption
Issuer: O = Self
Validity
Not Before: Dec 23 19:08:51 2018 GMT
Not After : Jan 22 19:08:51 2019 GMT
Subject: O = Self
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:example.com
with an actual CA, the subject could be empty, and the issuer will be the
CA's DN.
--
Viktor.
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
