Cannot specify a SAN with commas when using X509V3_EXT_conf_nid()
#27,690 建立於 2025年5月23日
倉庫指標
- Star
- (30,157 star)
- PR 合併指標
- (30 天內沒有已合併 PR)
描述
I am trying to generate CSR for a certificate request using Openssl 1.0.2zl. The certificate needs to have SAN in format specified by Microsoft for strong mapping (https://techcommunity.microsoft.com/blog/intunecustomersuccess/support-tip-implementing-strong-mapping-in-microsoft-intune-certificates/4053376) Basically the URI general name in SAN is supposed to have the value which is something like "tag:microsoft.com,2022-09-14:sid:". When I use the API X509V3_EXT_conf_nid(NULL, NULL, 85, (char *)value) where value is "URI:tag:microsoft.com,2022-09-14:sid:" the extension is returned as NULL. I think this method internally calls X509V3_parse_list which splits the string based on commas to get the key value pairs. But in this case the value of URI itself has colons and comma. This looks like the X509V3_EXT_conf_nid may need some enhancement. I believe this is applicable for 3.x openssl as well