fieldName is the field name being used, for example commonName (or CN). The prompt string is used to ask the user to enter the relevant details. If the user enters nothing then the default value is used if no default value is present then the field is omitted. A field can still be omitted if a default value is present if the user just enters the ’.’ character.

The number of characters entered must be between the fieldName_min and fieldName_max limits: there may be additional restrictions based on the field being used (for example countryName can only ever be two characters long and must fit in a PrintableString).

Some fields (such as organizationName) can be used more than once in a DN. This presents a problem because configuration files will not recognize the same name occurring twice. To avoid this problem if the fieldName contains some characters followed by a full stop they will be ignored. So for example a second organizationName can be input by calling it 1.organizationName.

The actual permitted field names are any object identifier short or long names. These are compiled into OpenSSL and include the usual values such as commonName, countryName, localityName, organizationName, organizationUnitName, stateOrProvinceName. Additionally emailAddress is include as well as name, surname, givenName initials and dnQualifier.

Additional object identifiers can be defined with the oid_file or oid_section options in the configuration file. Any additional fields will be treated as though they were a DirectoryString.

EXAMPLES

 openssl req -in req.pem -text -verify -noout

 openssl genrsa -out key.pem 1024
 openssl req -new -key key.pem -out req.pem

 openssl req -newkey rsa:1024 -keyout key.pem -out req.pem

 openssl req -x509 -newkey rsa:1024 -keyout key.pem -out req.pem

 1.2.3.4        shortName       A longer Name
 1.2.3.6        otherName       Other longer Name

 testoid1=1.2.3.5
 testoid2=${testoid1}.6

 [ req ]
 default_bits           = 1024
 default_keyfile        = privkey.pem
 distinguished_name     = req_distinguished_name
 attributes             = req_attributes
 x509_extensions        = v3_ca

 dirstring_type = nobmp

 [ req_distinguished_name ]
 countryName                    = Country Name (2 letter code)
 countryName_default            = AU
 countryName_min                = 2
 countryName_max                = 2

 localityName                   = Locality Name (eg, city)

 organizationalUnitName         = Organizational Unit Name (eg, section)

 commonName                     = Common Name (eg, YOUR name)
 commonName_max                 = 64

 emailAddress                   = Email Address
 emailAddress_max               = 40

 [ req_attributes ]
 challengePassword              = A challenge password
 challengePassword_min          = 4
 challengePassword_max          = 20

 [ v3_ca ]

 subjectKeyIdentifier=hash
 authorityKeyIdentifier=keyid:always,issuer:always
 basicConstraints = CA:true

 RANDFILE               = $ENV::HOME/.rnd

 [ req ]
 default_bits           = 1024
 default_keyfile        = keyfile.pem
 distinguished_name     = req_distinguished_name
 attributes             = req_attributes
 prompt                 = no
 output_password        = mypass

 [ req_distinguished_name ]
 C                      = GB
 ST                     = Test State or Province
 L                      = Test Locality
 O                      = Organization Name
 OU                     = Organizational Unit Name
 CN                     = Common Name
 emailAddress           = [email protected]

 [ req_attributes ]
 challengePassword              = A challenge password

 -----BEGIN CERTIFICATE REQUEST-----
 -----END CERTIFICATE REQUEST-----

 -----BEGIN NEW CERTIFICATE REQUEST-----
 -----END NEW CERTIFICATE REQUEST-----

        Using configuration from /some/path/openssl.cnf
        Unable to load config info

        unable to find ’distinguished_name’ in config
        problems making Certificate Request

        Attributes:
            a0:00

        Attributes: