From e890dcdb196aa2b971f3c85ccc94389bb01edb91 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Thu, 15 Mar 2001 22:45:20 +0000 Subject: [PATCH] Add 'align' option to nameopt. Add default values for display by the 'ca' utility to openssl.cnf Update docs. --- apps/apps.c | 1 + apps/openssl.cnf | 5 +++++ doc/apps/ca.pod | 27 +++++++++++++++++++++++---- doc/apps/x509.pod | 32 +++++++++++++++++++++++--------- 4 files changed, 52 insertions(+), 13 deletions(-) diff --git a/apps/apps.c b/apps/apps.c index ab30e53ba5..d8d9140075 100644 --- a/apps/apps.c +++ b/apps/apps.c @@ -796,6 +796,7 @@ int set_name_ex(unsigned long *flags, const char *arg) { "nofname", XN_FLAG_FN_NONE, XN_FLAG_FN_MASK}, { "sname", XN_FLAG_FN_SN, XN_FLAG_FN_MASK}, { "lname", XN_FLAG_FN_LN, XN_FLAG_FN_MASK}, + { "align", XN_FLAG_FN_ALIGN, 0}, { "oid", XN_FLAG_FN_OID, XN_FLAG_FN_MASK}, { "space_eq", XN_FLAG_SPC_EQ, 0}, { "dump_unknown", XN_FLAG_DUMP_UNKNOWN_FIELDS, 0}, diff --git a/apps/openssl.cnf b/apps/openssl.cnf index c089a21f27..f02b2bdf84 100644 --- a/apps/openssl.cnf +++ b/apps/openssl.cnf @@ -48,6 +48,11 @@ RANDFILE = $dir/private/.rand # private random number file x509_extensions = usr_cert # The extentions to add to the cert +# Comment out the following two lines for the "traditional" +# (and highly broken) format. +name_opt = ca_default # Subject Name options +cert_opt = ca_default # Certificate field options + # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs # so this is commented out by default to leave a V1 CRL. # crl_extensions = crl_ext diff --git a/doc/apps/ca.pod b/doc/apps/ca.pod index 5adf805a94..e441a620c1 100644 --- a/doc/apps/ca.pod +++ b/doc/apps/ca.pod @@ -317,6 +317,23 @@ the same as B<-msie_hack> the same as B<-policy>. Mandatory. See the B section for more information. +=item B, B + +these options allow the format used to display the certificate details +when asking the user to confirm signing. All the options supported by +the B utilities B<-nameopt> and B<-certopt> switches can be used +here, except the B and B are permanently set +and cannot be disabled (this is because the certificate signature cannot +be displayed because the certificate has not been signed at this point). + +For convenience the values B are accepted by both to produce +a reasonable output. + +If neither option is present the format used in earlier versions of +OpenSSL is used. Use of the old format is B discouraged because +it only displays fields mentioned in the B section, mishandles +multicharacter string types and does not display extensions. + =back =head1 POLICY FORMAT @@ -407,6 +424,9 @@ A sample configuration file with the relevant sections for B: policy = policy_any # default policy + nameopt = default_ca # Subject name display option + certopt = default_ca # Certificate display option + [ policy_any ] countryName = supplied stateOrProvinceName = optional @@ -420,7 +440,7 @@ A sample configuration file with the relevant sections for B: The B command is quirky and at times downright unfriendly. The B utility was originally meant as an example of how to do things -in a CA. It was not supposed be be used as a full blown CA itself: +in a CA. It was not supposed to be used as a full blown CA itself: nevertheless some people are using it for this purpose. The B command is effectively a single user command: no locking is @@ -487,9 +507,8 @@ exposed at either a command or interface level so a more friendly utility B help a little but not very much. Any fields in a request that are not present in a policy are silently -deleted. This does not happen if the B<-preserveDN> option is used but -the extra fields are not displayed when the user is asked to certify -a request. The behaviour should be more friendly and configurable. +deleted. This does not happen if the B<-preserveDN> option is used. +The behaviour should be more friendly and configurable. Cancelling some commands by refusing to certify a certificate can create an empty file. diff --git a/doc/apps/x509.pod b/doc/apps/x509.pod index dab9fa1333..a584785b47 100644 --- a/doc/apps/x509.pod +++ b/doc/apps/x509.pod @@ -115,9 +115,10 @@ any extensions present and any trust settings. =item B<-certopt option> -customise the output format used with B<-text>. This option may be used more -than once to set multiple options. See the B section for -more information. +customise the output format used with B<-text>. The B