[openssl-users] How to add CT Precertificate SCTs to a server certificate?

Dr. Stephen Henson steve at openssl.org
Mon Apr 20 15:52:29 UTC 2015

On Mon, Apr 20, 2015, Salz, Rich wrote:

> > How do we use `openssl req` and a CONF file to add the information
> > (assuming we already have the certified timestamps)?
> Ouch, that's gonna be nasty.  Look at ASN1_generate_nconf.pod  Most likely have to use the SEQUENCE type, recursively.  Ouch indeed.
> A patch to let you specify the DER directly would be useful.

You can use DER directly but CTs (at least those I've seen) don't use DER or
ASN.1 internally: they use TLS like syntax contained in an OCTET STRING wrapper.

So if you have the encoding of the CT you use the ASN.1 generator to produce
an OCTET STRING and place the hex form of the CT in that.

Dr Stephen N. Henson. OpenSSL project core developer.
Commercial tech support now available see: http://www.openssl.org

More information about the openssl-users mailing list