Are the 'ca' policy values that are present in the OpenSSL configuration file applied when the 'ca' command is used to create a certificate AND when the 'ca' command is used to sign an existing certificate? For example, suppose the following policy section is present in an OpenSSL configuration file:
[ policy_basic ]
commonName = supplied
organizationName = match
organizationalUnitName = supplied
streetAddress = optional
localityName = match
stateOrProvinceName = match
countryName = match
postalCode = optional
emailAddress = optional
If I used the 'ca' command to generate a Certificate Signing Request ("CSR"), and no values were supplied for the "optional" policy fields, would the CSR's Subject Name Relative Distinguished Names ("RDN") contain the following:
commonName = Whatever I entered at the prompt or was stipulated as the default
organizationName = The issuing CA certificate's Subject Name organizationName RDN
organizationalUnitName = Whatever I entered at the prompt or was stipulated as the default
streetAddress = Doesn't appear in CSR
localityName = The issuing CA certificate's Subject Name localityName RDN
stateOrProvinceName = The issuing CA certificate's Subject Name stateOrProvinceName RDN
countryName = The issuing CA certificate's Subject Name countryName RDN
postalCode = Doesn't appear in CSR
emailAddress = Doesn't appear in CSR
Now let's use the 'ca' command to sign an existing CSR. Using the values contained in the same [ policy_basic ]
policy section, are the following CSR Subject Name RDN values required to be present in the CSR before the CA certificate will be allowed to sign the CSR:
commonName =
organizationName = The issuing CA certificate's Subject Name organizationName RDN
organizationalUnitName =
streetAddress =
localityName = The issuing CA certificate's Subject Name localityName RDN
stateOrProvinceName = The issuing CA certificate's Subject Name stateOrProvincenName RDN
countryName = The issuing CA certificate's Subject Name countryName RDN
postalCode =
emailAddress =
I purposely only showed values for the CSR's Subject Name RDNs whose corresponding policy field value is "match" in order to focus attention on how the MATCH policy value works.
Are my examples correct? If so, is it correct that the ca policy values that are present in the OpenSSL configuration file are applied when the 'ca' command in used to BOTH create AND sign certificates?