974 lines
23 KiB
HTML
974 lines
23 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of X509V3_CONFIG</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>X509V3_CONFIG</H1>
|
|
Section: OpenSSL (5SSL)<BR>Updated: 2021-03-22<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
x509v3_config - X509 V3 certificate extension configuration format
|
|
<A NAME="lbAC"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
|
|
|
|
Several of the OpenSSL utilities can add extensions to a certificate or
|
|
certificate request based on the contents of a configuration file.
|
|
<P>
|
|
|
|
Typically the application will contain an option to point to an extension
|
|
section. Each line of the extension section takes the form:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
extension_name=[critical,] extension_options
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
If <B>critical</B> is present then the extension will be critical.
|
|
<P>
|
|
|
|
The format of <B>extension_options</B> depends on the value of <B>extension_name</B>.
|
|
<P>
|
|
|
|
There are four main types of extension: <I>string</I> extensions, <I>multi-valued</I>
|
|
extensions, <I>raw</I> and <I>arbitrary</I> extensions.
|
|
<P>
|
|
|
|
String extensions simply have a string which contains either the value itself
|
|
or how it is obtained.
|
|
<P>
|
|
|
|
For example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
nsComment="This is a Comment"
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Multi-valued extensions have a short form and a long form. The short form
|
|
is a list of names and values:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
basicConstraints=critical,CA:true,pathlen:1
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
The long form allows the values to be placed in a separate section:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
basicConstraints=critical,@bs_section
|
|
|
|
[bs_section]
|
|
|
|
CA=true
|
|
pathlen=1
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Both forms are equivalent.
|
|
<P>
|
|
|
|
The syntax of raw extensions is governed by the extension code: it can
|
|
for example contain data in multiple sections. The correct syntax to
|
|
use is defined by the extension code itself: check out the certificate
|
|
policies extension for an example.
|
|
<P>
|
|
|
|
If an extension type is unsupported then the <I>arbitrary</I> extension syntax
|
|
must be used, see the <FONT SIZE="-1">ARBITRARY EXTENSIONS</FONT> section for more details.
|
|
<A NAME="lbAD"> </A>
|
|
<H2>STANDARD EXTENSIONS</H2>
|
|
|
|
|
|
|
|
The following sections describe each supported extension in detail.
|
|
<A NAME="lbAE"> </A>
|
|
<H3>Basic Constraints.</H3>
|
|
|
|
|
|
|
|
This is a multi valued extension which indicates whether a certificate is
|
|
a <FONT SIZE="-1">CA</FONT> certificate. The first (mandatory) name is <B></B><FONT SIZE="-1"><B>CA</B></FONT><B></B> followed by <B></B><FONT SIZE="-1"><B>TRUE</B></FONT><B></B> or
|
|
<B></B><FONT SIZE="-1"><B>FALSE</B></FONT><B></B>. If <B></B><FONT SIZE="-1"><B>CA</B></FONT><B></B> is <B></B><FONT SIZE="-1"><B>TRUE</B></FONT><B></B> then an optional <B>pathlen</B> name followed by an
|
|
non-negative value can be included.
|
|
<P>
|
|
|
|
For example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
basicConstraints=CA:TRUE
|
|
|
|
basicConstraints=CA:FALSE
|
|
|
|
basicConstraints=critical,CA:TRUE, pathlen:0
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
A <FONT SIZE="-1">CA</FONT> certificate <B>must</B> include the basicConstraints value with the <FONT SIZE="-1">CA</FONT> field
|
|
set to <FONT SIZE="-1">TRUE.</FONT> An end user certificate must either set <FONT SIZE="-1">CA</FONT> to <FONT SIZE="-1">FALSE</FONT> or exclude the
|
|
extension entirely. Some software may require the inclusion of basicConstraints
|
|
with <FONT SIZE="-1">CA</FONT> set to <FONT SIZE="-1">FALSE</FONT> for end entity certificates.
|
|
<P>
|
|
|
|
The pathlen parameter indicates the maximum number of CAs that can appear
|
|
below this one in a chain. So if you have a <FONT SIZE="-1">CA</FONT> with a pathlen of zero it can
|
|
only be used to sign end user certificates and not further CAs.
|
|
<A NAME="lbAF"> </A>
|
|
<H3>Key Usage.</H3>
|
|
|
|
|
|
|
|
Key usage is a multi valued extension consisting of a list of names of the
|
|
permitted key usages.
|
|
<P>
|
|
|
|
The supported names are: digitalSignature, nonRepudiation, keyEncipherment,
|
|
dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly
|
|
and decipherOnly.
|
|
<P>
|
|
|
|
Examples:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
keyUsage=digitalSignature, nonRepudiation
|
|
|
|
keyUsage=critical, keyCertSign
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAG"> </A>
|
|
<H3>Extended Key Usage.</H3>
|
|
|
|
|
|
|
|
This extensions consists of a list of usages indicating purposes for which
|
|
the certificate public key can be used for,
|
|
<P>
|
|
|
|
These can either be object short names or the dotted numerical form of OIDs.
|
|
While any <FONT SIZE="-1">OID</FONT> can be used only certain values make sense. In particular the
|
|
following <FONT SIZE="-1">PKIX, NS</FONT> and <FONT SIZE="-1">MS</FONT> values are meaningful:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
Value Meaning
|
|
----- -------
|
|
serverAuth SSL/TLS Web Server Authentication.
|
|
clientAuth SSL/TLS Web Client Authentication.
|
|
codeSigning Code signing.
|
|
emailProtection E-mail Protection (S/MIME).
|
|
timeStamping Trusted Timestamping
|
|
OCSPSigning OCSP Signing
|
|
ipsecIKE ipsec Internet Key Exchange
|
|
msCodeInd Microsoft Individual Code Signing (authenticode)
|
|
msCodeCom Microsoft Commercial Code Signing (authenticode)
|
|
msCTLSign Microsoft Trust List Signing
|
|
msEFS Microsoft Encrypted File System
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Examples:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
extendedKeyUsage=critical,codeSigning,1.2.3.4
|
|
extendedKeyUsage=serverAuth,clientAuth
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAH"> </A>
|
|
<H3>Subject Key Identifier.</H3>
|
|
|
|
|
|
|
|
This is really a string extension and can take two possible values. Either
|
|
the word <B>hash</B> which will automatically follow the guidelines in <FONT SIZE="-1">RFC3280</FONT>
|
|
or a hex string giving the extension value to include. The use of the hex
|
|
string is strongly discouraged.
|
|
<P>
|
|
|
|
Example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
subjectKeyIdentifier=hash
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAI"> </A>
|
|
<H3>Authority Key Identifier.</H3>
|
|
|
|
|
|
|
|
The authority key identifier extension permits two options. keyid and issuer:
|
|
both can take the optional value ``always''.
|
|
<P>
|
|
|
|
If the keyid option is present an attempt is made to copy the subject key
|
|
identifier from the parent certificate. If the value ``always'' is present
|
|
then an error is returned if the option fails.
|
|
<P>
|
|
|
|
The issuer option copies the issuer and serial number from the issuer
|
|
certificate. This will only be done if the keyid option fails or
|
|
is not included unless the ``always'' flag will always include the value.
|
|
<P>
|
|
|
|
Example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
authorityKeyIdentifier=keyid,issuer
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAJ"> </A>
|
|
<H3>Subject Alternative Name.</H3>
|
|
|
|
|
|
|
|
The subject alternative name extension allows various literal values to be
|
|
included in the configuration file. These include <B>email</B> (an email address)
|
|
<B></B><FONT SIZE="-1"><B>URI</B></FONT><B></B> a uniform resource indicator, <B></B><FONT SIZE="-1"><B>DNS</B></FONT><B></B> (a <FONT SIZE="-1">DNS</FONT> domain name), <B></B><FONT SIZE="-1"><B>RID</B></FONT><B></B> (a
|
|
registered <FONT SIZE="-1">ID: OBJECT IDENTIFIER</FONT>), <B></B><FONT SIZE="-1"><B>IP</B></FONT><B></B> (an <FONT SIZE="-1">IP</FONT> address), <B>dirName</B>
|
|
(a distinguished name) and otherName.
|
|
<P>
|
|
|
|
The email option include a special 'copy' value. This will automatically
|
|
include any email addresses contained in the certificate subject name in
|
|
the extension.
|
|
<P>
|
|
|
|
The <FONT SIZE="-1">IP</FONT> address used in the <B></B><FONT SIZE="-1"><B>IP</B></FONT><B></B> options can be in either IPv4 or IPv6 format.
|
|
<P>
|
|
|
|
The value of <B>dirName</B> should point to a section containing the distinguished
|
|
name to use as a set of name value pairs. Multi values AVAs can be formed by
|
|
prefacing the name with a <B>+</B> character.
|
|
<P>
|
|
|
|
otherName can include arbitrary data associated with an <FONT SIZE="-1">OID:</FONT> the value
|
|
should be the <FONT SIZE="-1">OID</FONT> followed by a semicolon and the content in standard
|
|
<B><A HREF="/cgi-bin/man/man2html?3+ASN1_generate_nconf">ASN1_generate_nconf</A></B>(3) format.
|
|
<P>
|
|
|
|
Examples:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
subjectAltName=email:copy,email:<A HREF="mailto:my@other.address">my@other.address</A>,URI:<A HREF="http://my.url.here/">http://my.url.here/</A>
|
|
subjectAltName=IP:192.168.7.1
|
|
subjectAltName=IP:13::17
|
|
subjectAltName=email:<A HREF="mailto:my@other.address">my@other.address</A>,RID:1.2.3.4
|
|
subjectAltName=otherName:1.2.3.4;UTF8:some other identifier
|
|
|
|
subjectAltName=dirName:dir_sect
|
|
|
|
[dir_sect]
|
|
C=UK
|
|
O=My Organization
|
|
OU=My Unit
|
|
CN=My Name
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAK"> </A>
|
|
<H3>Issuer Alternative Name.</H3>
|
|
|
|
|
|
|
|
The issuer alternative name option supports all the literal options of
|
|
subject alternative name. It does <B>not</B> support the email:copy option because
|
|
that would not make sense. It does support an additional issuer:copy option
|
|
that will copy all the subject alternative name values from the issuer
|
|
certificate (if possible).
|
|
<P>
|
|
|
|
Example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
issuerAltName = issuer:copy
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAL"> </A>
|
|
<H3>Authority Info Access.</H3>
|
|
|
|
|
|
|
|
The authority information access extension gives details about how to access
|
|
certain information relating to the <FONT SIZE="-1">CA.</FONT> Its syntax is accessOID;location
|
|
where <I>location</I> has the same syntax as subject alternative name (except
|
|
that email:copy is not supported). accessOID can be any valid <FONT SIZE="-1">OID</FONT> but only
|
|
certain values are meaningful, for example <FONT SIZE="-1">OCSP</FONT> and caIssuers.
|
|
<P>
|
|
|
|
Example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
authorityInfoAccess = OCSP;URI:<A HREF="http://ocsp.my.host/">http://ocsp.my.host/</A>
|
|
authorityInfoAccess = caIssuers;URI:<A HREF="http://my.ca/ca.html">http://my.ca/ca.html</A>
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAM"> </A>
|
|
<H3><FONT SIZE="-1">CRL</FONT> distribution points</H3>
|
|
|
|
|
|
|
|
This is a multi-valued extension whose options can be either in name:value pair
|
|
using the same form as subject alternative name or a single value representing
|
|
a section name containing all the distribution point fields.
|
|
<P>
|
|
|
|
For a name:value pair a new DistributionPoint with the fullName field set to
|
|
the given value both the cRLissuer and reasons fields are omitted in this case.
|
|
<P>
|
|
|
|
In the single option case the section indicated contains values for each
|
|
field. In this section:
|
|
<P>
|
|
|
|
If the name is ``fullname'' the value field should contain the full name
|
|
of the distribution point in the same format as subject alternative name.
|
|
<P>
|
|
|
|
If the name is ``relativename'' then the value field should contain a section
|
|
name whose contents represent a <FONT SIZE="-1">DN</FONT> fragment to be placed in this field.
|
|
<P>
|
|
|
|
The name ``CRLIssuer'' if present should contain a value for this field in
|
|
subject alternative name format.
|
|
<P>
|
|
|
|
If the name is ``reasons'' the value field should consist of a comma
|
|
separated field containing the reasons. Valid reasons are: ``keyCompromise'',
|
|
``CACompromise'', ``affiliationChanged'', ``superseded'', ``cessationOfOperation'',
|
|
``certificateHold'', ``privilegeWithdrawn'' and ``AACompromise''.
|
|
<P>
|
|
|
|
Simple examples:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
crlDistributionPoints=URI:<A HREF="http://myhost.com/myca.crl">http://myhost.com/myca.crl</A>
|
|
crlDistributionPoints=URI:<A HREF="http://my.com/my.crl,URI:http://oth.com/my.crl">http://my.com/my.crl,URI:http://oth.com/my.crl</A>
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Full distribution point example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
crlDistributionPoints=crldp1_section
|
|
|
|
[crldp1_section]
|
|
|
|
fullname=URI:<A HREF="http://myhost.com/myca.crl">http://myhost.com/myca.crl</A>
|
|
CRLissuer=dirName:issuer_sect
|
|
reasons=keyCompromise, CACompromise
|
|
|
|
[issuer_sect]
|
|
C=UK
|
|
O=Organisation
|
|
CN=Some Name
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAN"> </A>
|
|
<H3>Issuing Distribution Point</H3>
|
|
|
|
|
|
|
|
This extension should only appear in CRLs. It is a multi valued extension
|
|
whose syntax is similar to the ``section'' pointed to by the <FONT SIZE="-1">CRL</FONT> distribution
|
|
points extension with a few differences.
|
|
<P>
|
|
|
|
The names ``reasons'' and ``CRLissuer'' are not recognized.
|
|
<P>
|
|
|
|
The name ``onlysomereasons'' is accepted which sets this field. The value is
|
|
in the same format as the <FONT SIZE="-1">CRL</FONT> distribution point ``reasons'' field.
|
|
<P>
|
|
|
|
The names ``onlyuser'', ``onlyCA'', ``onlyAA'' and ``indirectCRL'' are also accepted
|
|
the values should be a boolean value (<FONT SIZE="-1">TRUE</FONT> or <FONT SIZE="-1">FALSE</FONT>) to indicate the value of
|
|
the corresponding field.
|
|
<P>
|
|
|
|
Example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
issuingDistributionPoint=critical, @idp_section
|
|
|
|
[idp_section]
|
|
|
|
fullname=URI:<A HREF="http://myhost.com/myca.crl">http://myhost.com/myca.crl</A>
|
|
indirectCRL=TRUE
|
|
onlysomereasons=keyCompromise, CACompromise
|
|
|
|
[issuer_sect]
|
|
C=UK
|
|
O=Organisation
|
|
CN=Some Name
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAO"> </A>
|
|
<H3>Certificate Policies.</H3>
|
|
|
|
|
|
|
|
This is a <I>raw</I> extension. All the fields of this extension can be set by
|
|
using the appropriate syntax.
|
|
<P>
|
|
|
|
If you follow the <FONT SIZE="-1">PKIX</FONT> recommendations and just using one <FONT SIZE="-1">OID</FONT> then you just
|
|
include the value of that <FONT SIZE="-1">OID.</FONT> Multiple OIDs can be set separated by commas,
|
|
for example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
certificatePolicies= 1.2.4.5, 1.1.3.4
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
If you wish to include qualifiers then the policy <FONT SIZE="-1">OID</FONT> and qualifiers need to
|
|
be specified in a separate section: this is done by using the <TT>@section</TT> syntax
|
|
instead of a literal <FONT SIZE="-1">OID</FONT> value.
|
|
<P>
|
|
|
|
The section referred to must include the policy <FONT SIZE="-1">OID</FONT> using the name
|
|
policyIdentifier, cPSuri qualifiers can be included using the syntax:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
CPS.nnn=value
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
userNotice qualifiers can be set using the syntax:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
userNotice.nnn=@notice
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
The value of the userNotice qualifier is specified in the relevant section.
|
|
This section can include explicitText, organization and noticeNumbers
|
|
options. explicitText and organization are text strings, noticeNumbers is a
|
|
comma separated list of numbers. The organization and noticeNumbers options
|
|
(if included) must <FONT SIZE="-1">BOTH</FONT> be present. If you use the userNotice option with <FONT SIZE="-1">IE5</FONT>
|
|
then you need the 'ia5org' option at the top level to modify the encoding:
|
|
otherwise it will not be interpreted properly.
|
|
<P>
|
|
|
|
Example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
certificatePolicies=ia5org,1.2.3.4,1.5.6.7.8,@polsect
|
|
|
|
[polsect]
|
|
|
|
policyIdentifier = 1.3.5.8
|
|
CPS.1="<A HREF="http://my.host.name/">http://my.host.name/</A>"
|
|
CPS.2="<A HREF="http://my.your.name/">http://my.your.name/</A>"
|
|
userNotice.1=@notice
|
|
|
|
[notice]
|
|
|
|
explicitText="Explicit Text Here"
|
|
organization="Organisation Name"
|
|
noticeNumbers=1,2,3,4
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
The <B>ia5org</B> option changes the type of the <I>organization</I> field. In <FONT SIZE="-1">RFC2459</FONT>
|
|
it can only be of type DisplayText. In <FONT SIZE="-1">RFC3280</FONT> IA5String is also permissible.
|
|
Some software (for example some versions of <FONT SIZE="-1">MSIE</FONT>) may require ia5org.
|
|
<P>
|
|
|
|
<FONT SIZE="-1">ASN1</FONT> type of explicitText can be specified by prepending <B></B><FONT SIZE="-1"><B>UTF8</B></FONT><B></B>,
|
|
<B></B><FONT SIZE="-1"><B>BMP</B></FONT><B></B> or <B></B><FONT SIZE="-1"><B>VISIBLE</B></FONT><B></B> prefix followed by colon. For example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
[notice]
|
|
explicitText="UTF8:Explicit Text Here"
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAP"> </A>
|
|
<H3>Policy Constraints</H3>
|
|
|
|
|
|
|
|
This is a multi-valued extension which consisting of the names
|
|
<B>requireExplicitPolicy</B> or <B>inhibitPolicyMapping</B> and a non negative integer
|
|
value. At least one component must be present.
|
|
<P>
|
|
|
|
Example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
policyConstraints = requireExplicitPolicy:3
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAQ"> </A>
|
|
<H3>Inhibit Any Policy</H3>
|
|
|
|
|
|
|
|
This is a string extension whose value must be a non negative integer.
|
|
<P>
|
|
|
|
Example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
inhibitAnyPolicy = 2
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAR"> </A>
|
|
<H3>Name Constraints</H3>
|
|
|
|
|
|
|
|
The name constraints extension is a multi-valued extension. The name should
|
|
begin with the word <B>permitted</B> or <B>excluded</B> followed by a <B>;</B>. The rest of
|
|
the name and the value follows the syntax of subjectAltName except email:copy
|
|
is not supported and the <B></B><FONT SIZE="-1"><B>IP</B></FONT><B></B> form should consist of an <FONT SIZE="-1">IP</FONT> addresses and
|
|
subnet mask separated by a <B>/</B>.
|
|
<P>
|
|
|
|
Examples:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
nameConstraints=permitted;IP:192.168.0.0/255.255.0.0
|
|
|
|
nameConstraints=permitted;email:.somedomain.com
|
|
|
|
nameConstraints=excluded;email:.com
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAS"> </A>
|
|
<H3><FONT SIZE="-1">OCSP</FONT> No Check</H3>
|
|
|
|
|
|
|
|
The <FONT SIZE="-1">OCSP</FONT> No Check extension is a string extension but its value is ignored.
|
|
<P>
|
|
|
|
Example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
noCheck = ignored
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAT"> </A>
|
|
<H3><FONT SIZE="-1">TLS</FONT> Feature (aka Must Staple)</H3>
|
|
|
|
|
|
|
|
This is a multi-valued extension consisting of a list of <FONT SIZE="-1">TLS</FONT> extension
|
|
identifiers. Each identifier may be a number (0..65535) or a supported name.
|
|
When a <FONT SIZE="-1">TLS</FONT> client sends a listed extension, the <FONT SIZE="-1">TLS</FONT> server is expected to
|
|
include that extension in its reply.
|
|
<P>
|
|
|
|
The supported names are: <B>status_request</B> and <B>status_request_v2</B>.
|
|
<P>
|
|
|
|
Example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
tlsfeature = status_request
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAU"> </A>
|
|
<H2>DEPRECATED EXTENSIONS</H2>
|
|
|
|
|
|
|
|
The following extensions are non standard, Netscape specific and largely
|
|
obsolete. Their use in new applications is discouraged.
|
|
<A NAME="lbAV"> </A>
|
|
<H3>Netscape String extensions.</H3>
|
|
|
|
|
|
|
|
Netscape Comment (<B>nsComment</B>) is a string extension containing a comment
|
|
which will be displayed when the certificate is viewed in some browsers.
|
|
<P>
|
|
|
|
Example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
nsComment = "Some Random Comment"
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Other supported extensions in this category are: <B>nsBaseUrl</B>,
|
|
<B>nsRevocationUrl</B>, <B>nsCaRevocationUrl</B>, <B>nsRenewalUrl</B>, <B>nsCaPolicyUrl</B>
|
|
and <B>nsSslServerName</B>.
|
|
<A NAME="lbAW"> </A>
|
|
<H3>Netscape Certificate Type</H3>
|
|
|
|
|
|
|
|
This is a multi-valued extensions which consists of a list of flags to be
|
|
included. It was used to indicate the purposes for which a certificate could
|
|
be used. The basicConstraints, keyUsage and extended key usage extensions are
|
|
now used instead.
|
|
<P>
|
|
|
|
Acceptable values for nsCertType are: <B>client</B>, <B>server</B>, <B>email</B>,
|
|
<B>objsign</B>, <B>reserved</B>, <B>sslCA</B>, <B>emailCA</B>, <B>objCA</B>.
|
|
<A NAME="lbAX"> </A>
|
|
<H2>ARBITRARY EXTENSIONS</H2>
|
|
|
|
|
|
|
|
If an extension is not supported by the OpenSSL code then it must be encoded
|
|
using the arbitrary extension format. It is also possible to use the arbitrary
|
|
format for supported extensions. Extreme care should be taken to ensure that
|
|
the data is formatted correctly for the given extension type.
|
|
<P>
|
|
|
|
There are two ways to encode arbitrary extensions.
|
|
<P>
|
|
|
|
The first way is to use the word <FONT SIZE="-1">ASN1</FONT> followed by the extension content
|
|
using the same syntax as <B><A HREF="/cgi-bin/man/man2html?3+ASN1_generate_nconf">ASN1_generate_nconf</A></B>(3).
|
|
For example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
1.2.3.4=critical,ASN1:UTF8String:Some random data
|
|
|
|
1.2.3.4=ASN1:SEQUENCE:seq_sect
|
|
|
|
[seq_sect]
|
|
|
|
field1 = UTF8:field1
|
|
field2 = UTF8:field2
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
It is also possible to use the word <FONT SIZE="-1">DER</FONT> to include the raw encoded data in any
|
|
extension.
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
1.2.3.4=critical,DER:01:02:03:04
|
|
1.2.3.4=DER:01020304
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
The value following <FONT SIZE="-1">DER</FONT> is a hex dump of the <FONT SIZE="-1">DER</FONT> encoding of the extension
|
|
Any extension can be placed in this form to override the default behaviour.
|
|
For example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
basicConstraints=critical,DER:00:01:02:03
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAY"> </A>
|
|
<H2>WARNINGS</H2>
|
|
|
|
|
|
|
|
There is no guarantee that a specific implementation will process a given
|
|
extension. It may therefore be sometimes possible to use certificates for
|
|
purposes prohibited by their extensions because a specific application does
|
|
not recognize or honour the values of the relevant extensions.
|
|
<P>
|
|
|
|
The <FONT SIZE="-1">DER</FONT> and <FONT SIZE="-1">ASN1</FONT> options should be used with caution. It is possible to create
|
|
totally invalid extensions if they are not used carefully.
|
|
<A NAME="lbAZ"> </A>
|
|
<H2>NOTES</H2>
|
|
|
|
|
|
|
|
If an extension is multi-value and a field value must contain a comma the long
|
|
form must be used otherwise the comma would be misinterpreted as a field
|
|
separator. For example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
subjectAltName=URI:<A HREF="ldap://somehost.com/CN=foo,OU=bar">ldap://somehost.com/CN=foo,OU=bar</A>
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
will produce an error but the equivalent form:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
subjectAltName=@subject_alt_section
|
|
|
|
[subject_alt_section]
|
|
subjectAltName=URI:<A HREF="ldap://somehost.com/CN=foo,OU=bar">ldap://somehost.com/CN=foo,OU=bar</A>
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
is valid.
|
|
<P>
|
|
|
|
Due to the behaviour of the OpenSSL <B>conf</B> library the same field name
|
|
can only occur once in a section. This means that:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
subjectAltName=@alt_section
|
|
|
|
[alt_section]
|
|
|
|
email=<A HREF="mailto:steve@here">steve@here</A>
|
|
email=<A HREF="mailto:steve@there">steve@there</A>
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
will only recognize the last value. This can be worked around by using the form:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
[alt_section]
|
|
|
|
email.1=<A HREF="mailto:steve@here">steve@here</A>
|
|
email.2=<A HREF="mailto:steve@there">steve@there</A>
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbBA"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+req">req</A></B>(1), <B><A HREF="/cgi-bin/man/man2html?1+ca">ca</A></B>(1), <B><A HREF="/cgi-bin/man/man2html?1+x509">x509</A></B>(1),
|
|
<B><A HREF="/cgi-bin/man/man2html?3+ASN1_generate_nconf">ASN1_generate_nconf</A></B>(3)
|
|
<A NAME="lbBB"> </A>
|
|
<H2>COPYRIGHT</H2>
|
|
|
|
|
|
|
|
Copyright 2004-2019 The OpenSSL Project Authors. All Rights Reserved.
|
|
<P>
|
|
|
|
Licensed under the OpenSSL license (the ``License''). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file <FONT SIZE="-1">LICENSE</FONT> in the source distribution or at
|
|
<<A HREF="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</A>>.
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="1"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="2"><A HREF="#lbAC">DESCRIPTION</A><DD>
|
|
<DT id="3"><A HREF="#lbAD">STANDARD EXTENSIONS</A><DD>
|
|
<DL>
|
|
<DT id="4"><A HREF="#lbAE">Basic Constraints.</A><DD>
|
|
<DT id="5"><A HREF="#lbAF">Key Usage.</A><DD>
|
|
<DT id="6"><A HREF="#lbAG">Extended Key Usage.</A><DD>
|
|
<DT id="7"><A HREF="#lbAH">Subject Key Identifier.</A><DD>
|
|
<DT id="8"><A HREF="#lbAI">Authority Key Identifier.</A><DD>
|
|
<DT id="9"><A HREF="#lbAJ">Subject Alternative Name.</A><DD>
|
|
<DT id="10"><A HREF="#lbAK">Issuer Alternative Name.</A><DD>
|
|
<DT id="11"><A HREF="#lbAL">Authority Info Access.</A><DD>
|
|
<DT id="12"><A HREF="#lbAM"><FONT SIZE="-1">CRL</FONT> distribution points</A><DD>
|
|
<DT id="13"><A HREF="#lbAN">Issuing Distribution Point</A><DD>
|
|
<DT id="14"><A HREF="#lbAO">Certificate Policies.</A><DD>
|
|
<DT id="15"><A HREF="#lbAP">Policy Constraints</A><DD>
|
|
<DT id="16"><A HREF="#lbAQ">Inhibit Any Policy</A><DD>
|
|
<DT id="17"><A HREF="#lbAR">Name Constraints</A><DD>
|
|
<DT id="18"><A HREF="#lbAS"><FONT SIZE="-1">OCSP</FONT> No Check</A><DD>
|
|
<DT id="19"><A HREF="#lbAT"><FONT SIZE="-1">TLS</FONT> Feature (aka Must Staple)</A><DD>
|
|
</DL>
|
|
<DT id="20"><A HREF="#lbAU">DEPRECATED EXTENSIONS</A><DD>
|
|
<DL>
|
|
<DT id="21"><A HREF="#lbAV">Netscape String extensions.</A><DD>
|
|
<DT id="22"><A HREF="#lbAW">Netscape Certificate Type</A><DD>
|
|
</DL>
|
|
<DT id="23"><A HREF="#lbAX">ARBITRARY EXTENSIONS</A><DD>
|
|
<DT id="24"><A HREF="#lbAY">WARNINGS</A><DD>
|
|
<DT id="25"><A HREF="#lbAZ">NOTES</A><DD>
|
|
<DT id="26"><A HREF="#lbBA">SEE ALSO</A><DD>
|
|
<DT id="27"><A HREF="#lbBB">COPYRIGHT</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:06 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|