3

In the openssl.cnf file, I see fields like countryName, stateOrProvinceName etc which are typically present in the distinguished_name. Where can I get a list of fields which can be added to the distinguished_name?

I want to add a mobile(cellular) number to the distinguished_name. How do I go about doing this?

I tried adding stuff like telephoneName, telephone_default, telephone_min, telephone_max to distinguished_name in openssl.cnf but openssl seems to ignore it.

1 Answer 1

7

telephoneNumber is what you're looking for.

Add the following to openssl.cnf; I used the Ubuntu 14 system version to start with, section names may vary by your distribution:

Under policy_match and policy_anything sections (probably policy_* in whatever openssl.cnf you're using as a template):

telephoneNumber         = optional

Under req_distinguished_name section:

telephoneNumber                 = Telephone Number
telephoneNumber_min             = 11
telephoneNumber_max             = 40

Then generate a key and CSR as normal. The interactive prompts will now include a telephone number:

What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:Massachusetts
Locality Name (eg, city) []:Boston
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:www.example.com
Email Address []:[email protected]
Telephone Number []:617-555-1234

And you can verify that the telephone number makes it into the cert:

$ openssl x509 -in certificate.crt -text -noout | grep Subject:
Subject: C=US, ST=Massachusetts, L=Boston, O=Internet Widgits Pty Ltd, CN=www.example.com/[email protected]/telephoneNumber=617-555-1234
$

Some references as to how I figured this out:

RFC 5280 says that

Standard sets of attributes have been defined in the X.500 series of specifications [X.520].

A bit of Googling led me to Naming and Structuring Guidelines for X.500 (RFC 1617) which has section "4.4.7 Telecom Attributes". There's not much info there but it does state telephoneNumber. So I Googled for that along with openssl.cnf and found an example openssl.cnf file incorporating telephoneNumber. From there it was simple to test the necessary parameters on my own system.

Finally, knowing that telephoneNumber is a valid thing, it was possible to Google "site:openssl.org telephoneNumber" and the source code for obj_mac.h has that along with facsimileTelephoneNumber, homeTelephoneNumber, mobileTelephoneNumber, and pagerTelephoneNumber. (Personally, I think if you're just putting one number in, you should be general ("telephoneNumber") rather than pedantic ("mobileTelephoneNumber"), so that's what I've used above).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .