The RFC - 7030 section 4.2.2, EST protocol, suggests to use the Change Subject Name attribute when the client would like to use a different subject for the new issued certificate during reenrollment.

There are two things

  1. I can't use the OID name, it makes OpenSSL complain
4017006433750000:error:05800077:x509 certificate routines:X509_ATTRIBUTE_create_by_txt:invalid field name:../crypto/x509/x509_att.c:250:name=ChangeSubjectName

=> I used the OID instead, it seems to accept it (i guess).

  1. I can't include the child attributes into it (SAN, or subj or anything), and this is probably related to my OpenSSL syntax
[ req ]
default_bits           = 3072
distinguished_name     = req_distinguished_name
req_extensions         = v3_req
prompt                 = no
attributes             = req_attrs

[ req_distinguished_name ]
1.DC                   = org
2.DC                   = PKI
3.DC                   = Test
CN                     = test-localhost
emailAddress           = [email protected]

[ v3_req ]
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = localhost2.com

[ req_attrs ]  = @csn_attrs

[ csn_attrs ]
subjectAlt.1             = csn.com

And i get the following in my CSR

            Requested Extensions:
                X509v3 Extended Key Usage: 

Does anyone see what I'm doing wrong?

  • Sorry, I'm pretty sure you can't with commandline. Extensions can have structured data where known, or 'escape to nconf' where not, but PKCS10 attributes are set or prompted with the same code as DistinguishedName items (which confusingly are also called attributes in the official X.509/PKIX definition) and this only allows character strings. You could write a program using the library -- definitely in C or C++ or anything that directly calls C (like Java's new FFI), possibly in other things like python or perl depending on the binding. Apr 3 at 5:51
  • Huh...Ok, i was trying to avoid coding because I already know Golang has some broken attributes such as the challenge password, perhaps this one too. I'll still give it a try. It's still good to know it can't be done on OpenSSL, cause i felt like going in circle. Thanks
    – MoBe
    Apr 3 at 16:13


You must log in to answer this question.

Browse other questions tagged .