Override specific DN fields when signing csr

certificate-authoritycsropensslpki

When signing CSR on CA side, how can I override specific DN fields by custom value?
I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other values, like CN=, should be accepted from CSR.

openssl/ca/policy configuration only supports match and supplied options.

Best Answer

There isn't a way to override a field from the CSR using the OpenSSL configuration file. The configuration file can only supply default values. There are two options that I can see:

  1. If you're using the openssl ca command to sign a CSR, you can override the subject from the CSR using the -subject argument. So, get the subject from the CSR (openssl req -noout -subject -in req.pem), search-and-replace the fields you want to change, and specify the altered subject on the command line with -subject.
  2. If the static fields that you want are always going to have the same value, you could build your CA certificate so that your policy configuration can specify match for the static fields, i.e. your CA certificate contains the static values in its own fields (e.g. O, OU).
Related Topic