看起来OpenSSL总是显示＆＃34;不支持＆＃34;对于一个subjectAltName为＆＃34; otherName＆＃34;。
写入的字符串（通过M2Crypto，直接通过命令行通过openssl.cnf）：
1.2.3.4;UTF8:some other identifier
转储（openssl x509 -in test.crt -noout -text）：
c3:88:36:93:82:58:0c:08:7f
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Alternative Name:
othername:<unsupported>
Signature Algorithm: sha1WithRSAEncryption
05:76:d5:fc:d0:44:50:af:39:76:05:b4:cb:b6:99:9f:7c:c0:
通过OpenSSL源代码＆＃34; otherName＆＃34;，这对我来说很突出（在v3_alt.c中）：
1：
STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
GENERAL_NAME *gen, STACK_OF(CONF_VALUE) *ret)
{
unsigned char *p;
char oline[256], htmp[5];
int i;
switch (gen->type)
{
case GEN_OTHERNAME:
X509V3_add_value("othername","<unsupported>", &ret);
break;
case GEN_X400:
X509V3_add_value("X400Name","<unsupported>", &ret);
break;
case GEN_EDIPARTY:
X509V3_add_value("EdiPartyName","<unsupported>", &ret);
break;
2：
int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
{
unsigned char *p;
int i;
switch (gen->type)
{
case GEN_OTHERNAME:
BIO_printf(out, "othername:<unsupported>");
break;
case GEN_X400:
BIO_printf(out, "X400Name:<unsupported>");
break;
case GEN_EDIPARTY:
/* Maybe fix this: it is supported now */
BIO_printf(out, "EdiPartyName:<unsupported>");
break;
所以，我愿意打赌这个以及来自我上述尝试的经验知识意味着我不应该期待＆＃34; otherName＆＃34;值永远通过命令行或库调用正确呈现。这可能是因为它们是实际的，编码的ASN.1字符串。那么，我该怎么做呢？人们如何提取这些价值观？如果它们是实际的ASN.1字符串，是由开发人员解码它们吗？
答案 0 :(得分：8)
命令行实用程序不以有意义的方式支持subjectAlternateName（SAN）。但是，该库确实支持通过编程工作来访问这些值。
在我提出您的具体问题之前，请先看看Zakir Durumeric的helpful post on OpenSSL certificate parsing。该文章提供了许多有用的提示。
这是我在Linux / OpenSSL 1.0.1h上测试过的完整程序。它演示了如何访问SAN中的用户主体名称（UPN）。 UPN的OID是1.3.6.1.4.1.311.20.2.3。如果您需要找到不同的OID，请将您自己的调用添加到OBJ_create中，如下所示。
#include <stdio.h>
#include <stdlib.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
static const unsigned char test_cert_der[] = {
/* hex bytes of a cert in DER format */
};
int main() {
/* In this example, we're looking for the Microsoft UPN, which is present
* in X.509v3 certificates suitable for certificate-based authentication.
*/
int upn_nid = OBJ_create("1.3.6.1.4.1.311.20.2.3", "UPN", "userPrincipleName");
const unsigned char* in = test_cert_der;
X509 *cert = d2i_X509(NULL, &in, sizeof(test_cert_der));
if (cert == NULL) {
printf("Error\n");
return 1;
}
int version = ((int) X509_get_version(cert)) + 1;
if (version < 3) {
printf("Not a version 3 or later certificate.\n");
return 1;
}
/* Now, we can look at the extensions. These are already parsed into an internal
* format, a result of the call to d2i_X509(). We just need to loop through them,
* looking for the SAN.
*/
X509_EXTENSION *ext;
int next = X509_get_ext_count(cert);
int i;
for (i=0; i < next; i++) {
ext = X509_get_ext(cert, i);
if (OBJ_obj2nid(ext->object) == NID_subject_alt_name) {
/* OK, we found the SAN. Now parse its value as a stack of general names.
*/
in = ext->value->data;
GENERAL_NAMES *names = d2i_GENERAL_NAMES(NULL, &in, ext->value->length);
if (names == NULL) {
printf("GENERAL_NAMES not found\n");
continue;
}
int nbr_of_names = sk_GENERAL_NAME_num(names);
int j, nid;
char *astr;
for (j=0; j<nbr_of_names; j++) {
/* Each general name has an implicit context tag that identifies its
* type.
*/
const GENERAL_NAME *current_name = sk_GENERAL_NAME_value(names, j);
switch (current_name->type) {
case GEN_OTHERNAME:
/* Is this a UPN? */
nid = OBJ_obj2nid(current_name->d.otherName->type_id);
if (nid == upn_nid) {
astr = (char*)ASN1_STRING_data(current_name->d.otherName->
value->value.asn1_string);
} else {
/* TODO: add support for other OIDs here. */
astr = "GEN_OTHERNAME";
}
break;
case GEN_EMAIL:
astr = (char*)ASN1_STRING_data(current_name->d.rfc822Name);
break;
case GEN_DNS:
astr = (char*)ASN1_STRING_data(current_name->d.dNSName);
break;
case GEN_X400:
/* TODO: add support for X400 names here. */
astr = "GEN_X400";
break;
case GEN_DIRNAME:
/* TODO: add support for directory names here. */
astr = "GEN_DIRNAME";
break;
case GEN_EDIPARTY:
/* TODO: add support for EDI party names here. */
astr = "GEN_EDIPARTY";
break;
case GEN_URI:
astr = (char*)ASN1_STRING_data(current_name->d.uniformResourceIdentifier);
break;
case GEN_IPADD:
/* TODO: add support for IP addresses here. */
astr = "GEN_IPADD";
break;
case GEN_RID:
/* TODO: add support for registered IDs here. */
astr = "GEN_RID";
break;
default:
astr = "Unknown name type";
break;
}
printf("name #%d: %s\n", j, astr);
}
GENERAL_NAMES_free(names);
}
}
X509_free(cert);
/* free any resources consumed by call(s) to OBJ_create */
OBJ_cleanup();
return 0;
}
答案 1 :(得分：0)
找到了一种通过命令行打印otherName的方法：
https://serverfault.com/a/1018912/467108