openSSL Not Displaying all attributes

Question

Here's a background of what I've done so far:

• I've been able to add a CRL to a self signed certificate using OpenSSL (see attached). But I'm not sure how to create an X.509 certificate issued by this self-signed root (i.e. a leaf certificates from this CA)

• I've tried to create a leaf certificate from this CA using openssl req -new -nodes -out leafcert.pem -keyout private/leaf-key.pem -days 365, but I haven't been able to determine if the CRL is in this certificate... I've used the openSSL command:

openssl req -text -noout -verify -in leafcert.pem

But all I can see is the following:

verify OK
Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: C=US, ST=DC, L=Washington, O=Norkie, OU=Test, CN=Leaf/emailAddress=first.last@domain.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:c0:32:a0:f5:7e:59:86:9e:97:0c:a0:4b:65:38:
                    58:af:aa:44:86:8c:8f:2a:0a:89:e0:40:ee:8d:8e:
                    68:7d:e2:52:46:e8:19:e2:52:58:1f:a6:6c:d0:1d:
                    55:47:79:e2:f4:ff:b8:ff:7d:3e:80:cf:24:74:4d:
                    85:48:28:74:f4:71:13:2a:4d:cb:53:7f:b1:bb:d9:
                    fa:5e:8e:41:2b:ea:f8:ba:38:84:15:58:78:d9:44:
                    45:aa:af:54:55:71:f7:2b:74:1b:d5:18:e0:ad:af:
                    c8:fa:d8:3a:9e:1b:47:3a:a5:16:a1:1c:ff:bb:77:
                    da:df:49:2c:fc:ac:2c:64:c5
                Exponent: 65537 (0x10001)
        Attributes:
            challengePassword        :akronohio
    Signature Algorithm: sha1WithRSAEncryption
        9e:b8:d0:af:02:ee:0e:85:a4:f7:85:ff:6d:0a:94:41:d9:c9:
        f6:ba:ff:d4:91:84:45:6d:8e:52:fe:f9:30:bf:12:59:86:7c:
        ce:90:04:a1:3b:6f:71:99:16:ed:27:da:a6:f0:8f:f3:b6:f3:
        bd:0f:c1:68:35:3d:f0:22:60:b3:71:69:bb:71:6d:63:31:d9:
        05:0e:50:e2:53:d9:a3:af:08:b9:ae:50:03:f4:37:cd:a3:08:
        6c:3d:88:97:cf:34:47:2c:b8:2b:fa:82:ba:66:fb:b1:cc:82:
        38:bb:16:6b:50:d9:da:03:44:a7:b5:e5:a3:47:e5:a6:6b:8f:
        f3:69

It doesn't tell me who the leaf is issued by and if it has any crlDistributionPoints.

Answer 1

The content of the request barely matters. It's the content of the resulting certificate that counts.

No self-respecting CA (and hopefully none of those that are bundled by default with our browsers) should copy attributes in the CSR into the certificate without vetting them by another way. Therefore, there is little point in putting attributes in the CSR itself for CAs, since they really should decide what goes in by another means. (I've actually tried once to add extra extensions to a CSR and the commercial CA I used stripped them away and only put in what they said they would in accordance to the application form, quite rightly. Most of the time, they'll also remove the RDNs in your Subject DN for which they cannot vouch for, e.g. O= for a Domain Validated certificate.)

If you really want extensions in your request, turn in on in your openssl.cnf file (you may also have to use the -reqexts option with the openssl req command):

req_extensions = v3_req

(and fill in the corresponding [v3_req] section).

To issue End-Entity Certificates with the CRL distribution attributes, you need to add this to the openssl.cnf file.

(I'm assuming you have a copy of openssl.cnf in your current directory)

You'll be able to get your crlDistributionPoint extension as follows:

• Add this line to the [ v3_custom ] section:

  crlDistributionPoints = URI:http://example.com/my.crl
  

• Make the issuing process use these extensions:

  openssl x509 -req -days 365 -in file.csr \
               -signkey ca.key -out file.crt \
               -extfile openssl.cnf -extensions v3_custom