I'm building a CA based on the OpenSSL command line tools. I don't want to use the
openssl ca tool and its file based database though, instead I create certificates using the
openssl x509 tool directly and assign a random serial. (I want to manage revocations, serials and policies myself.)
This all works, the problem is that the subject line is copied directly from the CSR into the certificate when issuing a new certificate. I want to be able to override the subject. Unfortunately the
x509 command does not provide a
-subj <arg> parameter like the
ca command does.
As a workaround, I tried to rewrite the CSR itself. I can easily change the subject using
openssl req -in oldcsr.pem -subj "newsubj" -out newcsr.pem. But then of course the CSR signature is not valid anymore and
openssl x509 complains that the "signature did not match the certificate request". And I didn't find an easy way to ignore the signature.
Is there a way to override the subject of a CSR when generating a certificate, without using the
openssl ca tool?