1

When trying to go through some material for self-signing a certificate, one of the steps required me to set policy conditions in this config file. See: https://www.phildev.net/ssl/opensslconf.html

The idea is that when you select policy_match=match, certain fields in the CA's certificate "must match with the corresponding fields in the client certificate to be signed". Why would a CA's certificate have to have matching fields with a client's certificate?

It all doesn't make sense to me since the client could be an arbitrary entity that has nothing in common with the CA. Can someone explain the scenario in which these would have to match?

  • Crossdupe crypto.stackexchange.com/questions/37819/… Also certs issued by openssl ca are NOT selfsigned; selfsigned does mean signed under control of the same person, it means signed with the same key as is in the cert. – dave_thompson_085 Jul 20 '16 at 1:04
  • I had originally posted this on the crypto site, but all commenters assured me that it was the wrong place. Thats why came here. – Minaj Jul 20 '16 at 5:07
1

It is an arbitrary, administrative decision for the creator of CA what client certificates they want to enable to be signed by the CA.

The policy_match in the following configuration line:

policy          = policy_match

is a chosen name that corresponds to a particular section in the configuration file. That section defines in details each of the

[ policy_match ]
countryName             = match
stateOrProvinceName     = match
localityName            = supplied
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

Each of the DN fields for the client certificate can be assigned to have the same value as the CA (match), be required to be specified (supplied), or be optional (optional).

The same guide suggests another policy that matches your criteria of "the client could be an arbitrary entity that has nothing in common with the CA":

[ policy_anything ]
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

Yet if you wanted to create a CA for your organisation, that would allow issuing only certificates for that part of your organisation you can freely set for example:

policy          = policy_branch_1

[ policy_branch_1 ]
countryName             = match
stateOrProvinceName     = match
localityName            = match
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = supplied

Which would required the issued certificates to have first three DN fields matching the CA's certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.