On 2021-10-14 18:43, Philip Prindeville wrote:
Hi, I need to generate CSR's with some Extensions included that use our PEN's as allocated by IANA. Are there any examples of this? Also, I'm looking at X509_REQ_add_extensions_nid() and it takes a STACK_OF(X509_EXTENSION) but it doesn't seem to actually iterate through the stack... Is this code even correct? What am I missing? Ditto for X509_REQ_add_extensions(). Thanks, -Philip
I don't know how to do this via the API, but the source code for the command line tools may give some good clues. Here is how I would do it with the command line tools: First of all, you need to (administratively) decide how to subdivide your private OID tree belowyour enterprise ID. This would be a company internal document listing how you use the OIDsand where to put future OIDs of various kinds. Use whatever document editing system is usedfor other long term company documents. Something like: Redfish solutions has been allocated the following OID prefix via the IANA "Enterprise numbers"process: RedfishOid = 1.3.6.1.4.1.9999999 We subdivide this as follows: RedfishOid.1 = Redfish X.509 extensions RedfishOid.1.1 = FooBar extension, see design document RS12345 RedfishOid.1.2 = BazQux extension, see design document RS12346 RedfishOid.2 = Redfish SNMP extensions RedfishOid.2.1 = Redfish hardware-box-A SNMP extensions RedfishOid.3 = Redfish contributions to public standardisation efforts RedfishOid.4 = Redfish internal LDAP extensions used by HR Next for the OpenSSL command line tools, you need to add the individual X.509 relatedOIDs to the openssl.cnf file: In the [default] section: oid_section = new_oids In the [new_oids] section RedFishFooBar=1.3.6.1.4.1.9999999.1.1 RedFishBazQux=1.3.6.1.4.1.9999999.1.2 From there, you should be able to use the new OID names in relevant sections and options, using the generic syntax that explicitly states how each value needs to beencoded. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded
