openssl/openssl
在 GitHub 查看Display OID values next to alias in certificate text output
Open
#27,182 建立於 2025年3月27日
branch: masterhelp wantedtriaged: feature
倉庫指標
- Star
- (30,157 star)
- PR 合併指標
- (30 天內沒有已合併 PR)
描述
Background
When using openssl x509 -text -noout to display the certificate in text form, the displayed labels of the extensions are actually just aliases for OID's (Object ID's). For example, the Professional Information or basis for Admission extension in the output below corresponds to the 1.3.36.8.3.3 OID. Currently, you would only ever see OID's in the openssl output for unknown extensions.
echo "MIIC+jCCAqCgAwIBAgICG3owCgYIKoZIzj0EAwIwgYQxCzAJBgNVBAYTAkRFMR8wHQYDVQQKDBZnZW1hdGlrIEdtYkggTk9ULVZBTElEMTIwMAYDVQQLDClLb21wb25lbnRlbi1DQSBkZXIgVGVsZW1hdGlraW5mcmFzdHJ1a3R1cjEgMB4GA1UEAwwXR0VNLktPTVAtQ0EyOCBURVNULU9OTFkwHhcNMjEwNTA2MTUyNzM1WhcNMjYwNTA1MTUyNzM0WjB9MQswCQYDVQQGEwJBVDEoMCYGA1UECgwfUklTRSBHbWJIIFRFU1QtT05MWSAtIE5PVC1WQUxJRDEpMCcGA1UEBRMgMzg3NzgtVjAxSTAwMDFUMjAyMTA1MDYxNDM5NTk0NDYxGTAXBgNVBAMMEGRpc2MucnUuaWRwLnJpc2UwWjAUBgcqhkjOPQIBBgkrJAMDAggBAQcDQgAElo3SbQ2crhiNRf0/w+QoPQ4q650SJuS7Y2XblWfqfF4eBozMBAkBcFP5HGZ3xuJQIY2I/0S6+JW4Bo9kzOFWyaOCAQUwggEBMB0GA1UdDgQWBBR+ezMYT4ALe6Z/iKKS6n4IrDd8kDAfBgNVHSMEGDAWgBQAajiQ85muIY9S2u7BjG6ArWEiyTBPBggrBgEFBQcBAQRDMEEwPwYIKwYBBQUHMAGGM2h0dHA6Ly9vY3NwMi10ZXN0cmVmLmtvbXAtY2EudGVsZW1hdGlrLXRlc3Qvb2NzcC9lYzAOBgNVHQ8BAf8EBAMCB4AwIQYDVR0gBBowGDAKBggqghQATASBIzAKBggqghQATASBSzAMBgNVHRMBAf8EAjAAMC0GBSskCAMDBCQwIjAgMB4wHDAaMAwMCklEUC1EaWVuc3QwCgYIKoIUAEwEggQwCgYIKoZIzj0EAwIDSAAwRQIgVJ3MmANydZeBHAshzlZeTyz0IIZj3B/4NO2ZGbjAvNcCIQCTsarcikFbR+gdSGN7jswQ2vfjGrWyXUUTxGYgCVI4Qg==" | base64 --decode | openssl x509 -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 7034 (0x1b7a)
Signature Algorithm: ecdsa-with-SHA256
Issuer: C=DE, O=gematik GmbH NOT-VALID, OU=Komponenten-CA der Telematikinfrastruktur, CN=GEM.KOMP-CA28 TEST-ONLY
Validity
Not Before: May 6 15:27:35 2021 GMT
Not After : May 5 15:27:34 2026 GMT
Subject: C=AT, O=RISE GmbH TEST-ONLY - NOT-VALID, serialNumber=38778-V01I0001T20210506143959446, CN=disc.ru.idp.rise
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:96:8d:d2:6d:0d:9c:ae:18:8d:45:fd:3f:c3:e4:
28:3d:0e:2a:eb:9d:12:26:e4:bb:63:65:db:95:67:
ea:7c:5e:1e:06:8c:cc:04:09:01:70:53:f9:1c:66:
77:c6:e2:50:21:8d:88:ff:44:ba:f8:95:b8:06:8f:
64:cc:e1:56:c9
ASN1 OID: brainpoolP256r1
X509v3 extensions:
X509v3 Subject Key Identifier:
7E:7B:33:18:4F:80:0B:7B:A6:7F:88:A2:92:EA:7E:08:AC:37:7C:90
X509v3 Authority Key Identifier:
00:6A:38:90:F3:99:AE:21:8F:52:DA:EE:C1:8C:6E:80:AD:61:22:C9
Authority Information Access:
OCSP - URI:http://ocsp2-testref.komp-ca.telematik-test/ocsp/ec
X509v3 Key Usage: critical
Digital Signature
X509v3 Certificate Policies:
Policy: 1.2.276.0.76.4.163
Policy: 1.2.276.0.76.4.203
X509v3 Basic Constraints: critical
CA:FALSE
Professional Information or basis for Admission:
Entry 1:
Profession Info Entry 1:
Info Entries:
IDP-Dienst
Profession OIDs:
undefined (1.2.276.0.76.4.260)
Signature Algorithm: ecdsa-with-SHA256
Signature Value:
30:45:02:20:54:9d:cc:98:03:72:75:97:81:1c:0b:21:ce:56:
5e:4f:2c:f4:20:86:63:dc:1f:f8:34:ed:99:19:b8:c0:bc:d7:
02:21:00:93:b1:aa:dc:8a:41:5b:47:e8:1d:48:63:7b:8e:cc:
10:da:f7:e3:1a:b5:b2:5d:45:13:c4:66:20:09:52:38:42
For reference, similarly, the openssl asn1parse also doesn't output OID's unless the extension is unknown:
echo "MIIC+jCCAqCgAwIBAgICG3owCgYIKoZIzj0EAwIwgYQxCzAJBgNVBAYTAkRFMR8wHQYDVQQKDBZnZW1hdGlrIEdtYkggTk9ULVZBTElEMTIwMAYDVQQLDClLb21wb25lbnRlbi1DQSBkZXIgVGVsZW1hdGlraW5mcmFzdHJ1a3R1cjEgMB4GA1UEAwwXR0VNLktPTVAtQ0EyOCBURVNULU9OTFkwHhcNMjEwNTA2MTUyNzM1WhcNMjYwNTA1MTUyNzM0WjB9MQswCQYDVQQGEwJBVDEoMCYGA1UECgwfUklTRSBHbWJIIFRFU1QtT05MWSAtIE5PVC1WQUxJRDEpMCcGA1UEBRMgMzg3NzgtVjAxSTAwMDFUMjAyMTA1MDYxNDM5NTk0NDYxGTAXBgNVBAMMEGRpc2MucnUuaWRwLnJpc2UwWjAUBgcqhkjOPQIBBgkrJAMDAggBAQcDQgAElo3SbQ2crhiNRf0/w+QoPQ4q650SJuS7Y2XblWfqfF4eBozMBAkBcFP5HGZ3xuJQIY2I/0S6+JW4Bo9kzOFWyaOCAQUwggEBMB0GA1UdDgQWBBR+ezMYT4ALe6Z/iKKS6n4IrDd8kDAfBgNVHSMEGDAWgBQAajiQ85muIY9S2u7BjG6ArWEiyTBPBggrBgEFBQcBAQRDMEEwPwYIKwYBBQUHMAGGM2h0dHA6Ly9vY3NwMi10ZXN0cmVmLmtvbXAtY2EudGVsZW1hdGlrLXRlc3Qvb2NzcC9lYzAOBgNVHQ8BAf8EBAMCB4AwIQYDVR0gBBowGDAKBggqghQATASBIzAKBggqghQATASBSzAMBgNVHRMBAf8EAjAAMC0GBSskCAMDBCQwIjAgMB4wHDAaMAwMCklEUC1EaWVuc3QwCgYIKoIUAEwEggQwCgYIKoZIzj0EAwIDSAAwRQIgVJ3MmANydZeBHAshzlZeTyz0IIZj3B/4NO2ZGbjAvNcCIQCTsarcikFbR+gdSGN7jswQ2vfjGrWyXUUTxGYgCVI4Qg==" | base64 --decode | openssl asn1parse -inform DER -i
0:d=0 hl=4 l= 762 cons: SEQUENCE
4:d=1 hl=4 l= 672 cons: SEQUENCE
8:d=2 hl=2 l= 3 cons: cont [ 0 ]
10:d=3 hl=2 l= 1 prim: INTEGER :02
13:d=2 hl=2 l= 2 prim: INTEGER :1B7A
17:d=2 hl=2 l= 10 cons: SEQUENCE
19:d=3 hl=2 l= 8 prim: OBJECT :ecdsa-with-SHA256
29:d=2 hl=3 l= 132 cons: SEQUENCE
32:d=3 hl=2 l= 11 cons: SET
34:d=4 hl=2 l= 9 cons: SEQUENCE
36:d=5 hl=2 l= 3 prim: OBJECT :countryName
41:d=5 hl=2 l= 2 prim: PRINTABLESTRING :DE
45:d=3 hl=2 l= 31 cons: SET
47:d=4 hl=2 l= 29 cons: SEQUENCE
49:d=5 hl=2 l= 3 prim: OBJECT :organizationName
54:d=5 hl=2 l= 22 prim: UTF8STRING :gematik GmbH NOT-VALID
78:d=3 hl=2 l= 50 cons: SET
80:d=4 hl=2 l= 48 cons: SEQUENCE
82:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName
87:d=5 hl=2 l= 41 prim: UTF8STRING :Komponenten-CA der Telematikinfrastruktur
130:d=3 hl=2 l= 32 cons: SET
132:d=4 hl=2 l= 30 cons: SEQUENCE
134:d=5 hl=2 l= 3 prim: OBJECT :commonName
139:d=5 hl=2 l= 23 prim: UTF8STRING :GEM.KOMP-CA28 TEST-ONLY
164:d=2 hl=2 l= 30 cons: SEQUENCE
166:d=3 hl=2 l= 13 prim: UTCTIME :210506152735Z
181:d=3 hl=2 l= 13 prim: UTCTIME :260505152734Z
196:d=2 hl=2 l= 125 cons: SEQUENCE
198:d=3 hl=2 l= 11 cons: SET
200:d=4 hl=2 l= 9 cons: SEQUENCE
202:d=5 hl=2 l= 3 prim: OBJECT :countryName
207:d=5 hl=2 l= 2 prim: PRINTABLESTRING :AT
211:d=3 hl=2 l= 40 cons: SET
213:d=4 hl=2 l= 38 cons: SEQUENCE
215:d=5 hl=2 l= 3 prim: OBJECT :organizationName
220:d=5 hl=2 l= 31 prim: UTF8STRING :RISE GmbH TEST-ONLY - NOT-VALID
253:d=3 hl=2 l= 41 cons: SET
255:d=4 hl=2 l= 39 cons: SEQUENCE
257:d=5 hl=2 l= 3 prim: OBJECT :serialNumber
262:d=5 hl=2 l= 32 prim: PRINTABLESTRING :38778-V01I0001T20210506143959446
296:d=3 hl=2 l= 25 cons: SET
298:d=4 hl=2 l= 23 cons: SEQUENCE
300:d=5 hl=2 l= 3 prim: OBJECT :commonName
305:d=5 hl=2 l= 16 prim: UTF8STRING :disc.ru.idp.rise
323:d=2 hl=2 l= 90 cons: SEQUENCE
325:d=3 hl=2 l= 20 cons: SEQUENCE
327:d=4 hl=2 l= 7 prim: OBJECT :id-ecPublicKey
336:d=4 hl=2 l= 9 prim: OBJECT :brainpoolP256r1
347:d=3 hl=2 l= 66 prim: BIT STRING
415:d=2 hl=4 l= 261 cons: cont [ 3 ]
419:d=3 hl=4 l= 257 cons: SEQUENCE
423:d=4 hl=2 l= 29 cons: SEQUENCE
425:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Subject Key Identifier
430:d=5 hl=2 l= 22 prim: OCTET STRING [HEX DUMP]:04147E7B33184F800B7BA67F88A292EA7E08AC377C90
454:d=4 hl=2 l= 31 cons: SEQUENCE
456:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Authority Key Identifier
461:d=5 hl=2 l= 24 prim: OCTET STRING [HEX DUMP]:30168014006A3890F399AE218F52DAEEC18C6E80AD6122C9
487:d=4 hl=2 l= 79 cons: SEQUENCE
489:d=5 hl=2 l= 8 prim: OBJECT :Authority Information Access
499:d=5 hl=2 l= 67 prim: OCTET STRING [HEX DUMP]:3041303F06082B060105050730018633687474703A2F2F6F637370322D746573747265662E6B6F6D702D63612E74656C656D6174696B2D746573742F6F6373702F6563
568:d=4 hl=2 l= 14 cons: SEQUENCE
570:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Key Usage
575:d=5 hl=2 l= 1 prim: BOOLEAN :255
578:d=5 hl=2 l= 4 prim: OCTET STRING [HEX DUMP]:03020780
584:d=4 hl=2 l= 33 cons: SEQUENCE
586:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Certificate Policies
591:d=5 hl=2 l= 26 prim: OCTET STRING [HEX DUMP]:3018300A06082A8214004C048123300A06082A8214004C04814B
619:d=4 hl=2 l= 12 cons: SEQUENCE
621:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Basic Constraints
626:d=5 hl=2 l= 1 prim: BOOLEAN :255
629:d=5 hl=2 l= 2 prim: OCTET STRING [HEX DUMP]:3000
633:d=4 hl=2 l= 45 cons: SEQUENCE
635:d=5 hl=2 l= 5 prim: OBJECT :Professional Information or basis for Admission
642:d=5 hl=2 l= 36 prim: OCTET STRING [HEX DUMP]:30223020301E301C301A300C0C0A4944502D4469656E7374300A06082A8214004C048204
680:d=1 hl=2 l= 10 cons: SEQUENCE
682:d=2 hl=2 l= 8 prim: OBJECT :ecdsa-with-SHA256
692:d=1 hl=2 l= 72 prim: BIT STRING
Current state of openssl x509 display formats/options
-nameopt
It is possible to display the OID for the Subject/Issuer using the -nameopt oid option.
-nameoptoptionThis specifies how the subject or issuer names are displayed. See openssl-namedisplay-options(1) for details.
echo "MIIC+jCCAqCgAwIBAgICG3owCgYIKoZIzj0EAwIwgYQxCzAJBgNVBAYTAkRFMR8wHQYDVQQKDBZnZW1hdGlrIEdtYkggTk9ULVZBTElEMTIwMAYDVQQLDClLb21wb25lbnRlbi1DQSBkZXIgVGVsZW1hdGlraW5mcmFzdHJ1a3R1cjEgMB4GA1UEAwwXR0VNLktPTVAtQ0EyOCBURVNULU9OTFkwHhcNMjEwNTA2MTUyNzM1WhcNMjYwNTA1MTUyNzM0WjB9MQswCQYDVQQGEwJBVDEoMCYGA1UECgwfUklTRSBHbWJIIFRFU1QtT05MWSAtIE5PVC1WQUxJRDEpMCcGA1UEBRMgMzg3NzgtVjAxSTAwMDFUMjAyMTA1MDYxNDM5NTk0NDYxGTAXBgNVBAMMEGRpc2MucnUuaWRwLnJpc2UwWjAUBgcqhkjOPQIBBgkrJAMDAggBAQcDQgAElo3SbQ2crhiNRf0/w+QoPQ4q650SJuS7Y2XblWfqfF4eBozMBAkBcFP5HGZ3xuJQIY2I/0S6+JW4Bo9kzOFWyaOCAQUwggEBMB0GA1UdDgQWBBR+ezMYT4ALe6Z/iKKS6n4IrDd8kDAfBgNVHSMEGDAWgBQAajiQ85muIY9S2u7BjG6ArWEiyTBPBggrBgEFBQcBAQRDMEEwPwYIKwYBBQUHMAGGM2h0dHA6Ly9vY3NwMi10ZXN0cmVmLmtvbXAtY2EudGVsZW1hdGlrLXRlc3Qvb2NzcC9lYzAOBgNVHQ8BAf8EBAMCB4AwIQYDVR0gBBowGDAKBggqghQATASBIzAKBggqghQATASBSzAMBgNVHRMBAf8EAjAAMC0GBSskCAMDBCQwIjAgMB4wHDAaMAwMCklEUC1EaWVuc3QwCgYIKoIUAEwEggQwCgYIKoZIzj0EAwIDSAAwRQIgVJ3MmANydZeBHAshzlZeTyz0IIZj3B/4NO2ZGbjAvNcCIQCTsarcikFbR+gdSGN7jswQ2vfjGrWyXUUTxGYgCVI4Qg==" | base64 --decode | openssl x509 -text -noout -nameopt oid
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 7034 (0x1b7a)
Signature Algorithm: ecdsa-with-SHA256
Issuer: 2.5.4.6=DE, 2.5.4.10=gematik GmbH NOT-VALID, 2.5.4.11=Komponenten-CA der Telematikinfrastruktur, 2.5.4.3=GEM.KOMP-CA28 TEST-ONLY
Validity
Not Before: May 6 15:27:35 2021 GMT
Not After : May 5 15:27:34 2026 GMT
Subject: 2.5.4.6=AT, 2.5.4.10=RISE GmbH TEST-ONLY - NOT-VALID, 2.5.4.5=38778-V01I0001T20210506143959446, 2.5.4.3=disc.ru.idp.rise
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:96:8d:d2:6d:0d:9c:ae:18:8d:45:fd:3f:c3:e4:
28:3d:0e:2a:eb:9d:12:26:e4:bb:63:65:db:95:67:
ea:7c:5e:1e:06:8c:cc:04:09:01:70:53:f9:1c:66:
77:c6:e2:50:21:8d:88:ff:44:ba:f8:95:b8:06:8f:
64:cc:e1:56:c9
ASN1 OID: brainpoolP256r1
X509v3 extensions:
X509v3 Subject Key Identifier:
7E:7B:33:18:4F:80:0B:7B:A6:7F:88:A2:92:EA:7E:08:AC:37:7C:90
X509v3 Authority Key Identifier:
00:6A:38:90:F3:99:AE:21:8F:52:DA:EE:C1:8C:6E:80:AD:61:22:C9
Authority Information Access:
OCSP - URI:http://ocsp2-testref.komp-ca.telematik-test/ocsp/ec
X509v3 Key Usage: critical
Digital Signature
X509v3 Certificate Policies:
Policy: 1.2.276.0.76.4.163
Policy: 1.2.276.0.76.4.203
X509v3 Basic Constraints: critical
CA:FALSE
Professional Information or basis for Admission:
Entry 1:
Profession Info Entry 1:
Info Entries:
IDP-Dienst
Profession OIDs:
undefined (1.2.276.0.76.4.260)
Signature Algorithm: ecdsa-with-SHA256
Signature Value:
30:45:02:20:54:9d:cc:98:03:72:75:97:81:1c:0b:21:ce:56:
5e:4f:2c:f4:20:86:63:dc:1f:f8:34:ed:99:19:b8:c0:bc:d7:
02:21:00:93:b1:aa:dc:8a:41:5b:47:e8:1d:48:63:7b:8e:cc:
10:da:f7:e3:1a:b5:b2:5d:45:13:c4:66:20:09:52:38:42
-certopt
There is also a -certopt option but I don't see any existing option values that helps in this regard. The ext_parse and ext_dump options only work on unsupported extensions.
-certoptoptionCustomise the print format used with -text. The option argument can be a single option or multiple options separated by commas. The -certopt switch may be also be used more than once to set multiple options. See the "Text Printing Flags" section for more information.
Why is this useful?
The OID's are useful to explore when you're manually parsing a certificate and need to reference the correct values. For example, the x509-parser Rust crate only supports a handful of extensions and you need to parse things yourself for everything else. It's nice to use the openssl output as a reference while you're writing this logic.
Overall, it's just not very convenient to not have access to this information and hides the underlying source of truth.
Potential solutions
Add a new option to -certopt like ext_oid that will output the OID's alongside their aliases.
Perhaps this could even be part of the default output format in parenthesis next to the alias.