[openssl-users] 802.1AR certificate generation and the config file

Robert Moskowitz rgm at htt-consult.com
Fri Aug 11 17:08:22 UTC 2017

Why thank you, Viktor.  Let's see if I can get this right from RFC4108

On 08/11/2017 12:47 PM, Viktor Dukhovni wrote:
> On Fri, Aug 11, 2017 at 03:29:25PM +0000, Salz, Rich via openssl-users wrote:
>> In the certificate extensions section you do something like:
>> 	subjectAltName = dns:www.example.com, IP:
>> and so on.  The "pki.tgz"
>>> And further it seems you are saying there is no support for HMN at all.
>> Right.
> >From the x509v3_config manpage:
>         If an extension is not supported by the OpenSSL code then it must be
>         encoded using the arbitrary extension format. It is also possible to
>         use the arbitrary format for supported extensions. Extreme care should
>         be taken to ensure that the data is formatted correctly for the given
>         extension type.
>         There are two ways to encode arbitrary extensions.
>         The first way is to use the word ASN1 followed by the extension content
>         using the same syntax as ASN1_generate_nconf(3).  For example:
>,ASN1:UTF8String:Some random data
>          [seq_sect]
>          field1 = UTF8:field1
>          field2 = UTF8:field2
>         It is also possible to use the word DER to include the raw encoded data
>         in any extension.
>         The value following DER is a hex dump of the DER encoding of the
>         extension Any extension can be placed in this form to override the
>         default behaviour.  For example:
>          basicConstraints=critical,DER:00:01:02:03
       id-on-hardwareModuleName OBJECT IDENTIFIER ::= {
         iso(1) identified-organization(3) dod(6) internet(1) security(5)
         mechanisms(5) pkix(7) on(8) 4 }

       HardwareModuleName ::= SEQUENCE {
         hwType OBJECT IDENTIFIER,
         hwSerialNum OCTET STRING }

    The fields of the HardwareModuleName type have the following

    hwType is an object identifier that identifies the type of hardware
       module.  A unique object identifier names a hardware model and

    hwSerialNum is the serial number of the hardware module.  No
       particular structure is imposed on the serial number; it need not
       be an integer.  However, the combination of the hwType and
       hwSerialNum uniquely identifies the hardware module.

In my [ 8021ar_idevid ] section I would have a line:

then have:

[ HardwareModuleName ]
hwType= ??
hwSerialNum= ??

I would want the 'openssl req' command to prompt for hwType and 
hsSerialNum.  At least for now.

More information about the openssl-users mailing list