Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Well, I am not sure if I specified the question correctly.

While I was browsing web, I checked several SSL certificates and noticed that even Root Certificate doesn't have set all attributes of application(or however is it called). Cert companies makes another attributes for Class 1, Class 2, EV.

When I created my own CA Certificate it has:

-All rules of issue,

-All rules of applications.

And new certificates signed by this root has:

-All rules of applications.

Cert companies makes another attributes for Class 1, Class 2, EV. Is it possible to set those rules using OpenSSL.

share|improve this question
up vote 0 down vote accepted

I had to change usr_cert fields like: keyUsage and extendedKeyUsage to add special policies.

Additionally there is possibility to change nsCertType to change the type of certificate.

share|improve this answer
You should drop all ns*, they're legacy extensions: You answer would also help others better if you elaborated a bit on which (extended)keyUsage you used – Tobias Kienzler Feb 8 '13 at 11:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.