openssl/openssl

Cannot specify a SAN with commas when using X509V3_EXT_conf_nid()

Open

#27,690 建立於 2025年5月23日

在 GitHub 查看
 (2 留言) (0 反應) (0 負責人)C (11,262 fork)batch import
help wantedtriaged: feature

倉庫指標

Star
 (30,157 star)
PR 合併指標
 (30 天內沒有已合併 PR)

描述

I am trying to generate CSR for a certificate request using Openssl 1.0.2zl. The certificate needs to have SAN in format specified by Microsoft for strong mapping (https://techcommunity.microsoft.com/blog/intunecustomersuccess/support-tip-implementing-strong-mapping-in-microsoft-intune-certificates/4053376) Basically the URI general name in SAN is supposed to have the value which is something like "tag:microsoft.com,2022-09-14:sid:". When I use the API X509V3_EXT_conf_nid(NULL, NULL, 85, (char *)value) where value is "URI:tag:microsoft.com,2022-09-14:sid:" the extension is returned as NULL. I think this method internally calls X509V3_parse_list which splits the string based on commas to get the key value pairs. But in this case the value of URI itself has colons and comma. This looks like the X509V3_EXT_conf_nid may need some enhancement. I believe this is applicable for 3.x openssl as well

貢獻者指南