Modify Certificate Subject using OpenSSL x509 Command

Question

I'm building a CA based on the OpenSSL command line tools. I don't want to use the openssl ca tool and its file based database though, instead I create certificates using the openssl x509 tool directly and assign a random serial. (I want to manage revocations, serials and policies myself.)

This all works, the problem is that the subject line is copied directly from the CSR into the certificate when issuing a new certificate. I want to be able to override the subject. Unfortunately the x509 command does not provide a -subj <arg> parameter like the ca command does.

As a workaround, I tried to rewrite the CSR itself. I can easily change the subject using openssl req -in oldcsr.pem -subj "newsubj" -out newcsr.pem. But then of course the CSR signature is not valid anymore and openssl x509 complains that the "signature did not match the certificate request". And I didn't find an easy way to ignore the signature.

Is there a way to override the subject of a CSR when generating a certificate, without using the openssl ca tool?

Answer 1

Very late and really ugly, but ... in OpenSSL 1.1.0 (released in 2016, a few months after this Q) up you can accomplish this by going the other direction:

 # extract the pubkey from the real CSR
 openssl req -in realcsr -pubkey -out realpub
 # create a _fake_ CSR with the correct subject and any keypair 
 # (I use a throwaway for simplicity but if you have another you can use that) 
 openssl req -newkey rsa:512 -nodes -keyout fakekey -subj "/C=US/ST=Maine/L=Cabot Cove/CN=Jessica Fletcher" -out fakecsr
 # issue a cert for the subject from the fake CSR but the real pubkey!
 openssl x509 -req -in fakecsr -force_pubkey realpub -CA ca_cert_and_key -out newcert 
 # add other options as needed e.g. -outform pem -$hash -days 30 -set_serial 1234 -extfile extns 

Answer 2

My example:

Generate a self-signed certificate (and private key)

$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -sha256 -keyout mydomain_rsa.PEM.key -out mydomain.PEM.csr -subj "/C=CN/O=Company Inc."
   Generating a 2048 bit RSA private key  
   ..........................+++  
   ........+++  
   writing new private key to 'mydomain_rsa.PEM.key'  
   -----  

View the subject

$ openssl x509 -noout -serial -subject -in mydomain.PEM.csr
  serial=CCC8F2F4B4BEDBAC
  subject= /C=CN/O=Company Inc.

Modify the subject

openssl req -x509 -in mydomain.PEM.csr -subj '/O=Company2 Inc.' -key mydomain_rsa.PEM.key -out new_mydomain.PEM.csr

View the subject of the new certificate

$ openssl x509 -noout -serial -subject -in new_mydomain.PEM.csr
  serial=A873BD71BCD0DFF7
  subject= /O=Company2 Inc

Answer 3

My example:

The first certificate with a new private key

openssl req -new -newkey rsa:2048 -nodes -sha256 -days 365 -keyout certificateExample.key -out certificateExample.csr
openssl x509 -req -in certificateExample.csr -signkey certificateExample.key -out certificateExample.cer

The second certificate, with the old private key

openssl req -new -sha256 -days 365 -key certificateExample.key -subj /O=Contoso -out certificateExampleContoso.csr
openssl x509 -req -in certificateExampleContoso.csr -signkey certificateExample.key -out certificateExampleContoso.cer

To view the subject names

openssl x509 -noout -serial -subject -in certificateExampleContoso.cer
serial=C6E02EB9402CEABD
subject=O = Contoso

The key is to generate a new certificate signing request (CSR) with the new subject name. As the CSR itself is signed, you cannot "transform" an old CSR into a new CSR with a different subject name. That's why I generated a new CSR with the new subject name.