I want to test a csr to see which extensions it is made by. specially I want to see if request is a Ca:False to CA:True one.

I try to view Csr using

openssl req -in a.csr -noout -text

but it isn't declared.

how to test it?


A PKCS#10 request contains attributes. One of the possible attributes is Extension Request defined in section 5.4.2 of PKCS#9: it contains a list of certificate extensions that the requester would like to see in the certificate. If OpenSSL shows no such attribute, or that attribute is present but does not contain a Basic Constraints extension, then the request indeed does not suggest that the certificate should be tagged as "CA".

Note, though, that these extensions are just hints. The CA still decides what goes in the certificate.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.