Add custom attributes to a CSR using OpenSSL
Use custom certificate signing request (CSR) attributes to provide additional values during enrollment without including those values in the issued certificate.
The custom attribute object identifiers (OIDs) and their values are defined in an OpenSSL configuration file.
Before you begin:
Install OpenSSL
Determine the OIDs and values for the custom attributes
Select a secure location for the generated private key
Create the OpenSSL configuration file
Create a file named custom_attributes.cnf with the following content.
JSON structure example:
oid_section = OIDs [ req ] default_bits = 2048 prompt = no encrypt_key = no default_md = sha1 distinguished_name = dn req_extensions = req_ext [ OIDs ] attribute001=1.2.3.4.5.1023.128.5 attribute002=1.2.3.4.5.1023.128.6 [ dn ] CN=Demo emailAddress=john.smith@quovadisglobal.com O=DigiCert C=US attribute001=device_identifier attribute002=additional_param [ req_ext ] subjectAltName = email:johnsmith@quovadisglobal.com
The [OIDs] section associates each attribute name with its OID:
attribute001 = 1.2.3.4.5.1023.128.5 attribute002 = 1.2.3.4.5.1023.128.6
The [dn] section assigns a value to each custom attribute:
attribute001 = device_identifier attribute002 = additional_param
Replace the example OIDs and values with the custom attributes required for your enrollment workflow.
Generate the private key and CSR
Run the following command from the directory containing custom_attributes.cnf:
openssl req -newkey rsa:2048 \ -keyout custom_attributes_demo.key \ -out custom_attributes_demo.csr \ -config custom_attributes.cnf
The above command creates:
custom_attributes_demo.key: The private keycustom_attributes_demo.csr: The CSR containing the custom attributes
Important
Protect the private key from unauthorized access. Do not share it with the CSR.
Verify the CSR
Inspect the generated CSR before submitting it:
openssl req \ -in custom_attributes_demo.csr \ -noout \ -text \ -verify
Confirm that:
The CSR signature is valid
The subject contains the expected distinguished name values
The custom attribute OIDs and values are present
The subject alternative name contains the expected value
After verification, submit the custom_attributes_demo.csr through the applicable enrollment workflow. The custom attributes are available for enrollment processing but are not added to the issued certificate when excluded by the certificate-template configuration.