Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow complete customized of common name with new switch #216

Open
jeremybusk opened this issue Nov 10, 2023 · 0 comments
Open

Allow complete customized of common name with new switch #216

jeremybusk opened this issue Nov 10, 2023 · 0 comments

Comments

@jeremybusk
Copy link

jeremybusk commented Nov 10, 2023

First, this is an excellent project. Thank you!

However, it would be nice to have a --subject option in order to have complete control over the common name that is limited by assumptions of --common-name

Example

certstrap init --key-bits=4096 --passphrase "fooo" --common-name "foo, DC = example, DC = com" --exclude-path-length
openssl x509 --text -in out/foo\,_DC_\=_example\,_DC_\=_com.crt | grep "Subject: CN"

returns

Subject: CN = "foo, DC = example, DC = com"

instead of
Subject: CN = foo, DC = example, DC = com

OpenSSL will allow you to do this with

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout a.key -out a.crt -subj "/DC=com/DC=example/CN=foo"

This might be nitty but there are times it is nice to not have certstrap adding quotes or auto prefixing CN

Maybe there is a reason for controlling CN as full control causes more issues with the file auto format. I'm still playing around with it but it would appear init and request-cert seem to create different auto out file formats when using "=" and "," in the CN.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant