openssl command allows to create x509 certificates, and to add subjectDN using the -subj parameter. The parameter accepts a string of slash-delimited values in the form of:




I could not find a complete list of the allowed keys, and I need to create a certificate with the following extentions:

  • organizationName (O)
  • commonName (CN)
  • uri (?!)
  • organizationIdentifier (?!)
  • countryName (C)
  • localityName (L)

of which uri and organizationIdentifier I have no clue on how to include. to my knowledge (fairly limited, i am just starting in the digital signature world), the values this parameter can incorporate are:

  • Country Name (C)
  • State or province (ST)
  • Locality (L)
  • Organization Name (O)
  • Organizational Unit Name (...)
  • Common Name (CN)
  • Email Address (...)

Is there a place where I can find the complete list of possibile attributes and their abbreviation? or maybe something other than openssl that allows to build the certificate ? Is it possible that to add the extra fields (uri, OrganizationIdentifier) the addtext argument must be used? Thank you in advance for your time and understending. Best regards

1 Answer 1


In an X.500 distinguished name the "keys" represent Object Identifiers abbreviated OIDs. This includes the Subject and Issuer names in an X.509 certificate and also the Subject name in a PKCS10 CSR, and quite a few other things.

I could not find a complete list of the allowed keys.

There is no complete list. The OID assignment scheme allows unlimited hierarchical expansion -- this is like asking for a complete list of all URLs in the world. OpenSSL predefines a fixed but large set of OIDs that have been standardized or at least widely used; see the header obj_mac.h on your system if you have a 'development' version of OpenSSL installed (i.e. headers and libraries suitable for compiling your own code, rather than merely running precompiled code) or if you have source code the crypto/objects.txt file from which obj_mac.h is derived or in the repository. In the former file the LN_ string is the 'long name' and SN_ is the 'short name' or abbreviation, if different. In the latter file these are just columns on one line, with the short name first or empty to indicate there is no distinct abbreviation. For example CN is the short name and commonName the long name for the OID 'X509 3' which, using other definitions in the file, expands to the actual OID

If you -- or (more likely) someone or something you are interoperating with -- needs an OID outside of OpenSSL's predefined set, either because it's standard but rare and/or new, or because it's not standard at all, then you can still use it in OpenSSL by defining it in your configuration file; see the oid_file and oid_section items in the man page for req or for ca or the generic config for other commands like x509.

Typically the OIDs defined in X.509, and those defined for X.509 in PKCS9 (such as emailAddress), are commonly used in X.509 subjects, but technically any OID can be. As you can see in the predefined list(s), there is an X509-scope OID for long name organizationIdentifier with no different short name -- this MAY be what your specifier wants, although it may not. There is no such obviously applicable OID for a URI, or URL; ask them to be precise about what they want, or to give/show you an example that shows precisely what they want.

I need to create a certificate with the following extentions:
Is it possible ... the addtext argument must be used? [You mean -addext in req]

These are not extensions. X.509 certificates have name fields containing attributes, which are one thing and the thing you want, and separately (but similarly identified by OIDs) they have extensions, which are a completely different thing that you do NOT want. Or at least not for this purpose; as you proceed you may find you also want extensions for something completely different that the specifier 'forgot'.

  • thank you for the very informative and detailed answer. Assuming the OID organizationIdentifier of x509 namespace is what i'm after, how would i insert it in my certificate using the openssl command ? Just as another parameter of the -subj string? "/.../objectIdentifier=.../..."?
    – darkpirate
    Mar 1, 2021 at 7:54
  • dark: yes. Or you can add it to the set of values or prompts in the config file and use that, but that's more work. Mar 3, 2021 at 8:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .