X509V3_CONFIG(5ssl) OpenSSL X509V3_CONFIG(5ssl) x509v3_config - X509 V3 OpenSSL -addext. config(5). . extensions . : name = [critical, ]value(s) critical . . values name . : string multi-valued raw arbitrary . . . : basicConstraints = critical, CA:true, pathlen:1 : [extensions] basicConstraints = critical, @basic_constraints [basic_constraints] CA = true pathlen = 1 . . : subjectAltName = URI:ldap://somehost.com/CN=foo,OU=bar : [extensions] subjectAltName = @subject_alt_section [subject_alt_section] subjectAltName = URI:ldap://somehost.com/CN=foo,OU=bar . OpenSSL . : [extensions] subjectAltName = @alt_section [alt_section] email = steve@example.com email = steve@example.org . : [extensions] subjectAltName = @alt_section [alt_section] email.1 = steve@example.com email.2 = steve@example.org . " " . " " . . . CA. CA TRUE FALSE. CA TRUE pathlen . : basicConstraints = CA:TRUE basicConstraints = CA:FALSE basicConstraints = critical, CA:TRUE, pathlen:1 CA basicConstraints CA TRUE. CA:FALSE . pathlen CA . pathlen CA CA . . : "digitalSignature" "nonRepudiation" ( "contentCommitment") "keyEncipherment" "dataEncipherment" "keyAgreement" "keyCertSign" "cRLSign" "encipherOnly" "decipherOnly". : keyUsage = digitalSignature, nonRepudiation keyUsage = digitalSignature, contentCommitment keyUsage = critical, keyCertSign . OID. : Value Meaning according to RFC 5280 etc. ----- ---------------------------------- serverAuth SSL/TLS WWW Server Authentication clientAuth SSL/TLS WWW Client Authentication codeSigning Code Signing emailProtection E-mail Protection (S/MIME) timeStamping Trusted Timestamping OCSPSigning OCSP Signing ipsecIKE ipsec Internet Key Exchange msCodeInd Microsoft Individual Code Signing (authenticode) msCodeCom Microsoft Commercial Code Signing (authenticode) msCTLSign Microsoft Trust List Signing msEFS Microsoft Encrypted File System IETF RFC 5280 id-kp-serverAuth id-kp-clientAuth WWW TLS OpenSSL . : extendedKeyUsage = critical, codeSigning, 1.2.3.4 extendedKeyUsage = serverAuth, clientAuth SKID . none SKID. hash RFC 5280 4.2.1.2. (1): keyIdentifier SHA-1 160 BIT STRING subjectPublicKey ( ). A hex string (possibly with ":" separating bytes) . . x509 req ca hash. : subjectKeyIdentifier = hash AKID none AKID. keyid issuer ",". always ":" . AKID always . x509 req ca none keyid"," issuer . keyid (SKID) . . always . issuer always keyid DN . . : authorityKeyIdentifier = keyid, issuer authorityKeyIdentifier = keyid, issuer:always email ( ) URI ( ) DNS ( DNS) RID ( : OBJECT IDENTIFIER) IP ( IP) dirName ( ) otherName. . email . "copy" . "move" . IP IP IPv4 IPv6. dirName . AVAs + . otherName OID OID ASN1_generate_nconf(3). : subjectAltName = email:copy, email:my@example.com, URI:http://my.example.com/ subjectAltName = IP:192.168.7.1 subjectAltName = IP:13::17 subjectAltName = email:my@example.com, RID:1.2.3.4 subjectAltName = otherName:1.2.3.4;UTF8:some other identifier [extensions] subjectAltName = dirName:dir_sect [dir_sect] C = UK O = My Organization OU = My Unit CN = My Name ASCII 3.3 RFC 6531 otherName.SmtpUTF8Mailbox. RFC 8398 UTF8String. SmtpUTF8Mailbox subjectAltName=@alts [alts] otherName = 1.3.6.1.5.5.7.8.9;FORMAT:UTF8,UTF8String:nonasciiname.example.com email:copy. issuer:copy . : issuerAltName = issuer:copy CA. access_id;location access_id ( ) location ( email:copy ). access_id OCSP ( OCSP) caIssuers ( CA) ad_timestamping ( AD) AD_DVCS (ad dvcs) caRepository ( CA). : authorityInfoAccess = OCSP;URI:http://ocsp.example.com/,caIssuers;URI:http://myca.example.com/ca.cer authorityInfoAccess = OCSP;URI:http://ocsp.example.com/ CRL - (subject alternative name) . - DistributionPoint fullName distributionPoint reasons cRLIssuer. : fullname . relativename (distinguished name) nameRelativeToCRLIssuer. CRLIssuer . reasons . : "keyCompromise" "CACompromise" "affiliationChanged" "superseded" "cessationOfOperation" "certificateHold" "privilegeWithdrawn" "AACompromise". fullname relativename . : crlDistributionPoints = URI:http://example.com/myca.crl crlDistributionPoints = URI:http://example.com/myca.crl, URI:http://example.org/my.crl : [extensions] crlDistributionPoints = crldp1_section [crldp1_section] fullname = URI:http://example.com/myca.crl CRLissuer = dirName:issuer_sect reasons = keyCompromise, CACompromise [issuer_sect] C = UK O = Organisation CN = Some Name CRLs. "" CRL. : fullname . relativename (distinguished name) nameRelativeToCRLIssuer. onlysomereasons . : "keyCompromise" "CACompromise" "affiliationChanged" "superseded" "cessationOfOperation" "certificateHold" "privilegeWithdrawn" "AACompromise". onlyuser, onlyCA, onlyAA, indirectCRL (boolean). : [extensions] issuingDistributionPoint = critical, @idp_section [idp_section] fullname = URI:http://example.com/myca.crl indirectCRL = TRUE onlysomereasons = keyCompromise, CACompromise . OID. . : certificatePolicies = 1.2.4.5, 1.1.3.4 "@section" . OID policyIdentifier. cPSuri : CPS.nnn = value "nnn" . userNotice : userNotice.nnn = @notice userNotice . explicitText organization noticeNumbers. explicitText organization noticeNumbers . organization noticeNumbers ( ) . ia5org Displaytext IA5String. : [extensions] certificatePolicies = ia5org, 1.2.3.4, 1.5.6.7.8, @polsect [polsect] policyIdentifier = 1.3.5.8 CPS.1 = "http://my.host.example.com/" CPS.2 = "http://my.your.example.com/" userNotice.1 = @notice [notice] explicitText = "Explicit Text Here" organization = "Organisation Name" noticeNumbers = 1, 2, 3, 4 explicitText UTF8 BMP VISIBLE . : [notice] explicitText = "UTF8:Explicit Text Here" requireExplicitPolicy inhibitPolicyMapping . . : policyConstraints = requireExplicitPolicy:3 . : inhibitAnyPolicy = 2 . permitted excluded ;. subjectAltName email:copy IP IP /. : nameConstraints = permitted;IP:192.168.0.0/255.255.0.0 nameConstraints = permitted;email:.example.com nameConstraints = excluded;email:.com OCSP . . : noCheck = ignored TLS ( Must Staple) TLS. (0..65535) . TLS TLS . : status_request status_request_v2. : tlsfeature = status_request Netscape . . Netscape Netscape (nsComment) . : nsBaseUrl nsRevocationUrl nsCaRevocationUrl nsRenewalUrl nsCaPolicyUrl nsSslServerName. Netscape (flags) . . basicConstraints keyUsage extended key usage . nsCertType : client server email objsign reserved sslCA emailCA objCA. OpenSSL . . . . ASN1 ASN1_generate_nconf(3). : [extensions] 1.2.3.4 = critical, ASN1:UTF8String:Some random data 1.2.3.4.1 = ASN1:SEQUENCE:seq_sect [seq_sect] field1 = UTF8:field1 field2 = UTF8:field2 DER . 1.2.3.4 = critical, DER:01:02:03:04 1.2.3.4.1 = DER:01020304 DER DER . . : basicConstraints = critical, DER:00:01:02:03 . . DER ASN1 . . openssl-req(1), openssl-ca(1), openssl-x509(1), ASN1_generate_nconf(3) 2004-2025 OpenSSL. . Apache 2.0 ( ""). . LICENSE . 3 . . : . 3.6.2 7 2026 X509V3_CONFIG(5ssl)