Subject name Generating Requests

246

10.3.1 Generating Requests

Recall that an X.509 certificate is a public key packaged with information about the certificate owner and issuer. Thus, to make a request, we must generate a public and private key on which well base our certificate. Well start our discussion assuming generation of the key pair has already been completed see Chapter 8 for details. An X.509 certificate request is represented by an X509_REQ object in OpenSSL. As we learned in Chapter 3 , a certificate requests main component is the public half of the key pair. It also contains a subjectName field and additional X.509 attributes. In reality, the attributes are optional parameters for the request, but the subject name should always be present. As well see, creating a certificate is not a very difficult task.

10.3.1.1 Subject name

Before looking at an example, we need a little more background information on subject name manipulation with the API. The object type X509_NAME represents a certificate name. Specifically, a certificate request has only a subject name, while full certificates contain a subject name and an issuer name. The purpose of the name field is to fully identify an entity, whether it is a server, person, corporation, etc. To this end, a name field is composed of several entries for country name, organization name, and common name, just to name a few. Again, we can think of the fields in a name as keyvalue pairs; the key is the name of the field, and the value is its content. In theory, there can be arbitrary fields in a name, but in practice, a few standard ones are expected. In OpenSSL, fields are internally identified through an integer value known as the NID. All of this information rapidly becomes relevant when it comes time to build the subject name of our request. As weve already said, a certificate name is represented by an X509_NAME object. This object is essentially a collection of X509_NAME_ENTRY objects. Each X509_NAME_ENTRY object represents a single field and the corresponding value. Thus, our application needs to generate a X509_NAME_ENTRY object for each of the fields well put in the name of the certificate request. The process is simple. First, we look up the NID of the field we need to create. Using the NID, we create the X509_NAME_ENTRY object and add our data. The entry is added to the X509_NAME , and we repeat the process until all the desired fields are entered. After the name is fully assembled, we can add it to an X509_REQ object. OpenSSL provides many functions for manipulating X509_NAME and X509_NAME_ENTRY objects that enable us to perform the subject name assembly using many different methods. For instance, the function call X509_NAME_add_entry_by_txt automatically looks up the NID, creates the entry, and adds it to the X509_NAME . In the example below, we elected to show the explicit implementation instead of demonstrating the kinds of operations that are available.

10.3.1.2 X.509 Version 3 extensions