Re: openssl x509 certificate question

On Mon, Feb 02, 2026 at 02:13:56PM -0800, SIMON BABY wrote:

> I would like to know if we can have a client certificate with out any
> extensions in the x509 extensions? Can this function still pass
> through? X509_verify_cert ().

Yes, that should be fine.  The "clientAuth" extended key usage OID is
only required when the EKU extension is present, in its absence the
certiificate is good for all extended key usages.

Unfortunately, some time back the "openssl req" and "openssl x509"
command-line utilities were changed to automatically add
subjectKeyIdentifier and/or authorityKeyIdentifier extensions.
That really should have been left to the user to decide, but at least
there's an explicit mechanism to ask to turn these off.  So, to really
get no extensions, for now you have to ask harder.

Example, (in practice, you'll avoid the >(...) bash wizardry used with
"-out" and "-keyout"):

    $ openssl req -nodes -x509 -new -newkey ed25519 \
        -keyout >(openssl pkey -noout -text) \
        -config <(printf "[exts]\nsubjectKeyIdentifier = none\n") \
        -subj "/CN=ClientName" -extensions exts \
        -not_after 99991231235959Z \
        -out >(openssl x509 -noout -text) \
        2>/dev/null | cat
    ED25519 Private-Key:
    priv:
        18:ef:53:84:10:01:ed:ee:df:27:67:03:c6:0f:b4:
        02:b5:60:bd:7b:69:8e:0e:97:00:0a:53:65:6b:f5:
        e1:cb
    pub:
        69:99:7d:2b:17:44:26:00:7d:37:7b:80:c5:e5:e6:
        cd:b5:a2:ad:c0:dc:ea:22:16:90:a9:54:a1:82:77:
        5c:7b
    Certificate:
        Data:
            Version: 3 (0x2)
            Serial Number:
                47:73:10:46:b0:b0:ca:cd:3a:84:92:0b:a5:0b:7d:1e:fe:43:e9:1a
            Signature Algorithm: ED25519
            Issuer: CN=ClientName
            Validity
                Not Before: Feb  3 01:57:09 2026 GMT
                Not After : Dec 31 23:59:59 9999 GMT
            Subject: CN=ClientName
            Subject Public Key Info:
                Public Key Algorithm: ED25519
                    ED25519 Public-Key:
                    pub:
                        69:99:7d:2b:17:44:26:00:7d:37:7b:80:c5:e5:e6:
                        cd:b5:a2:ad:c0:dc:ea:22:16:90:a9:54:a1:82:77:
                        5c:7b
        Signature Algorithm: ED25519
        Signature Value:
            12:e6:fe:c3:ae:f0:67:50:9c:04:9e:fd:0f:da:0a:c5:a1:b5:
            f3:a7:5d:8b:1f:f3:d2:a9:5d:95:80:c3:c3:33:ca:8d:14:75:
            2a:ad:22:76:85:9e:b9:ce:57:8a:2d:8e:2a:80:bf:db:dd:68:
            4c:5d:3b:48:15:e8:d2:ec:9d:09

-- 
    Viktor.  🇺🇦 Слава Україні!

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aYFWle5JFb_2ckFp%40chardros.imrryr.org.