I am trying to generate a certificate through OpenSSL which has the following line

X509v3 Certificate Policies: 
    Policy: X509v3 Any Policy

But I end up getting

X509v3 Certificate Policies:
    Policy: itu-t

What change do I need in my openssl.cnf to get "X509v3 Any Policy"?

I don't see any itu-t reference in my cnf file - so I don't know where that is coming from?

  • 'itu-t' is the decoding of a zero "OID" (in quotes, because an OID isn't valid without at least two arcs). Apparently you did something wrong. Two approaches: What actually is in your cert? Run openssl asn1parse <cert.pem and five lines after the end of your subject name you should have 'cont[3]' then SEQUENCE then one or more SEQUENCE of OBJECT (meaning OID) and OCTET STRING. Find the OCTET STRING just after OBJECT : X509v3 Certificate Policies. Take the number at the left of that line and redo asn1parse adding -strparse $num. ... Jul 4, 2014 at 13:36
  • ... The other approach is how did you create this cert? Give details. Hint: If I just configure certificatePolicies=anyPolicy in the exts section selected by the subcommand and options I use, it works as expected. Jul 4, 2014 at 13:39
  • @dave_thompson_085 - how did I create what cert?
    – user93353
    Jul 4, 2014 at 14:34
  • The one where you 'end up getting' 'itu-t' which you say is not what you want. To expand, there are at least 5 different ways of creating a cert with openssl commandline, and how you add extensions like the one you ask about depends on which of these ways you are using. Jul 5, 2014 at 7:30

1 Answer 1


There is probably a more elegant way to do it, but I add the following option to the [ v3_ca ] section of my OpenSSL configuration file:

certificatePolicies =

The OID values are available at http://www.alvestrand.no/objectid/ .

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .