bon, j'ai eu ma réponse sur la liste openssl-users :
This is only supported in 'req' and only then in 0.9.8-dev. You just precede
the component with a + so you have "+commonName" etc in openssl.cnf and it
should output a request in the appropriate format. You'll need -nameopt though
if you want it to display properly because the default (broken) DN format
doesn't notice the difference.
If you use 'ca' to sign the request any kind of policy data is likely to mess
things up but if you use the preserveDN quirk it should sign the request
properly.
These things are called multi-valued RDSs of AVAs and several less polite
names. Its been reported that some software doesn't handle them properly.
# Re: pour les pros d'openssl
Posté par Nap . En réponse au journal pour les pros d'openssl. Évalué à 1.
This is only supported in 'req' and only then in 0.9.8-dev. You just precede
the component with a + so you have "+commonName" etc in openssl.cnf and it
should output a request in the appropriate format. You'll need -nameopt though
if you want it to display properly because the default (broken) DN format
doesn't notice the difference.
If you use 'ca' to sign the request any kind of policy data is likely to mess
things up but if you use the preserveDN quirk it should sign the request
properly.
These things are called multi-valued RDSs of AVAs and several less polite
names. Its been reported that some software doesn't handle them properly.
Steve.
--
Dr Stephen N. Henson.