I am trying to generate a certificate through OpenSSL which has the following line

X509v3 Certificate Policies: 
    Policy: X509v3 Any Policy

But I end up getting

X509v3 Certificate Policies:
    Policy: itu-t

What change do I need in my openssl.cnf to get "X509v3 Any Policy"?

I don't see any itu-t reference in my cnf file - so I don't know where that is coming from?

  • 'itu-t' is the decoding of a zero "OID" (in quotes, because an OID isn't valid without at least two arcs). Apparently you did something wrong. Two approaches: What actually is in your cert? Run openssl asn1parse <cert.pem and five lines after the end of your subject name you should have 'cont[3]' then SEQUENCE then one or more SEQUENCE of OBJECT (meaning OID) and OCTET STRING. Find the OCTET STRING just after OBJECT : X509v3 Certificate Policies. Take the number at the left of that line and redo asn1parse adding -strparse $num. ... Jul 4 '14 at 13:36
  • ... The other approach is how did you create this cert? Give details. Hint: If I just configure certificatePolicies=anyPolicy in the exts section selected by the subcommand and options I use, it works as expected. Jul 4 '14 at 13:39
  • @dave_thompson_085 - how did I create what cert?
    – user93353
    Jul 4 '14 at 14:34
  • The one where you 'end up getting' 'itu-t' which you say is not what you want. To expand, there are at least 5 different ways of creating a cert with openssl commandline, and how you add extensions like the one you ask about depends on which of these ways you are using. Jul 5 '14 at 7:30

There is probably a more elegant way to do it, but I add the following option to the [ v3_ca ] section of my OpenSSL configuration file:

certificatePolicies =

The OID values are available at http://www.alvestrand.no/objectid/ .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.