OpenSSL self signed certificate with a common name longer than 64 bytes

openssl

I can create a self signed certificate using openSSL as follows: 

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days XXX -nodes

The interface somehow restricts me to 64 bytes for the common name. How can I create a certificate that has a common name longer than 64 bytes?

Best Answer

In my case, all the answers of "don't do this, it's against standards" were very unhelpful since I needed to do this as part of a reverse engineering challenge. In my case, the fact that it was against the standards didn't matter whatsoever.

Here are the (rough) steps:

  1. Download the latest source of libressl from https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/ (I used 2.6.0 because it's the version that ships on macOS Mojave)
  2. Unzip/tar/gz and then open /crypto/asn1/a_mbstr.c in your favorite editor

  3. Search for something that looks like the following:

    if ((maxsize > 0) && (nchar > maxsize)) {
    ASN1error(ASN1_R_STRING_TOO_LONG);
    ERR_asprintf_error_data("maxsize=%ld", maxsize);
    return -1;
}

    and comment it out. For version 2.6.0, this was on lines 155-159. By removing these lines, you are removing the max CN length check.

  4. Follow the directions in the README file to build the binary. I didn't need to install any libraries when I built on macOS but YMMV. I used cmake which dropped the new openssl binary in /build/apps/openssl

  5. Generate a CSR using the command line flags (read: NOT THE INTERACTIVE TOOL -- it has a special check that is not patched out by this modification!).

    For example:

    /build/apps/openssl/openssl req -new -newkey rsa:2048 -nodes -out a.csr -keyout a.key -subj "/CN=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

  6. Using the stock openssl binaries (or the modified ones, if you want), sign the CSR: 

    openssl x509 -req -in a.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out a.crt -days 500 -sha256

After that, you should have your wonderful non-compliant certificate ready to use. I have noticed quite a few issues with using certificates with CNs longer than 64 characters (Wireshark truncates the CN in the disector display, etc) but it does in fact work for what I needed.

Related Question