Search code examples
openssl

openssl issuer/subject format differences

I get different issuer/subject format for two OpenSSL versions: OpenSSL 1.1.1 and OpenSSL 1.0.2n. Can 1.1.1 version format subject/issuer like 1.0.2n does?

$ openssl x509 -in cert.pem -noout -issuer

# 1.1.1 11 Sep 2018
issuer=C = RU, O = TestOrg, OU = TestOrg Certification Authority, CN = rsa

# 1.0.2n 7 Dec 2017
issuer= /C=RU/O=TestOrg/OU=TestOrg Certification Authority/CN=rsa
Solution

  • You need to use the "-nameopt compat" option. e.g.

    openssl x509 -in cert.pem -noout -issuer -nameopt compat

    From documentation:

    -nameopt option

    option which determines how the subject or issuer names are displayed. The option argument can be a single option or multiple options separated by commas. Alternatively the -nameopt switch may be used more than once to set multiple options. See the NAME OPTIONS section for more information.

    and

    compat

    use the old format. This is equivalent to specifying no name options at all.