I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA. Is this possible?
I want to get a SSL server certificate issued by a standard CA, so that it'll be accepted by standard browsers. However, I have a small amount of extra data that will be used by my private application that I'd also like to have included in the certificate. I'm looking for a way to include it in the certificate, in a way that standard browsers will ignore and (critically) that the CA won't strip out.
Is there a field or place where I can store arbitrary data, without it being stripped out by public CAs?
otherName part of
subjectAltName: will it be preserved by any standard CA? Should I be looking at a custom x509 extension?
The critical requirement is that for this to be not stripped out or modified by the CA. I need there to exist at least one CA that's trusted by major browsers, and won't strip out this custom data. I know that some fields of the certificate signing request (CSR) are filtered or stripped out by CAs, but I haven't been able to find documentation on which ones (if any) allow arbitrary data and will be preserved from the CSR into the final cert.
This question is related, but not the same: it doesn't have the requirement that the certificate be signed by a CA that's trusted by modern browsers. Also, I've found lots of information about how to add custom extensions to a x509 CSR, but that's not what I'm looking for; that doesn't tell me which extension to stuff the data into (which extension won't be stripped by major CAs). I know how to create a CSR containing custom data, but I don't know which fields of the CSR will get copied unmodified into the final server cert. I'm also not looking for a solution that involves running my own CA: I want the server cert to be accepted by standard browsers. This question also looks similar, but I don't see a clear answer there.