I'm testing a service that might not do a proper checks for the certificate chain but instead it checks issuer and subject fields only. I would need to create a (self signed?) certificate with different issuer and subject. Is this possible with OpenSSL

For example:

openssl req -new -sha256 -key mydomain.com.key -subj "/C=US/ST=CA/O=MyOrg, Inc./CN=mydomain.com" -out mydomain.com.csr

Sets both issuer and subject with the same C/O/CN fields. I cannot find a params for openssl to force different fields. Any suggestions for alternative tool?

  • "with different issuer and subject" -- different from what? – schroeder Sep 16 '19 at 6:52
  • When making your own certificate that will not actually be used for signing, you can put whatever you like in the fields. – schroeder Sep 16 '19 at 6:53

You put self signed with a question mark without making clear if you understand what it means, namely a cert signed by the same key it contains (not just one you signed or caused to be signed). Or to be more exact, a cert signed by the private half of the keypair whose public half is contained in the cert, so that it verifies with its own key, although that verification is meaningless for security. If you do want that:

  1. Create a keypair and a root-CA cert for that key. Any root-CA certs must, by definition, have subject=issuer and be self-signed i.e. signed by the same key it contains.

  2. Create a child cert for that same keypair with a different subject name and other data as desired, issued/signed by the root-CA. It will thus be signed by the same keypair it contains, but have different names.

  3. Use the child cert and if you don't need the root cert just discard it.

If not self-signed that's the normal case. Just create a CA keypair and cert, and then issue a child cert (or several) under that CA with a different name(s) and different keypair(s) and other data as desired. All certs, except root-CA and dummy/trivial self-signed EE certs, should always have subject not equal to issuer -- in fact using the same name for subject and issuer of a cert that isn't root or self-signed will usually confuse reliers and cause validation error or reject.

The one thing you can't do with OpenSSL is create cert(s) under -- that is, correctly signed by -- a 'real' CA like Verisign/Symantec/Digicert, GoDaddy, or LetsEncrypt. Thus any cert you create should not validate for any properly implemented relier by default, only if you or someone adds your 'local' CA to its truststore.

  • Thanks! Good explanation, I clearly have some more studies to do with PKI and x.509 :-) – Petteri H Sep 16 '19 at 7:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.