Is there a standard way of adding a custom data field, in my case a mac address, to a certificate. I sign them myself and they are used in a closed environment.

What I would like is a mechanism so that I can specify the mac address parameter via the commandline when calling "openssl req...", maybe using the "-subj" line.

  • Is it possible to write the openssl.cnf in such a way that a new field is added in the extensions section that can be set via the commandline option. I.e. if the fieldname is "mac" then via -subj ".../mac=0x023445344556..." or some other commandline switch.

Or is there some other way i.e. via environment variables...


You can add custom attributes to certificates, assuming you are using x509v3.

This SO post provides the basics, which is that you need to use a config file, and create an actual attribute.

Your example is adding a field to the DN, which is a different thing.

  • If I only have one openssl.cnf and define a new OID field, how can I set the value when generating different cert requests: Is there an option to fetch it from the enviroment or via commandline switch? Apr 4 '17 at 18:56
  • Sorry, I think I found how to get the parameters from the enviromnent variables: ${ENV::name}... Apr 4 '17 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.