what req_extensions should I pass to openssl to include "S/MIME Capabilities" into my CSR?

Please see example openssl s_client outpout below from installed certificate.

I aware of

"X509v3 extensions" - keyUsage= attribute.


"X509v3 Extended Key Usage" - extendedKeyUsage= attribute.

openssl s_client output:

X509v3 extensions:
    X509v3 Key Usage: critical
        Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment

    S/MIME Capabilities: 
        050...{some binary like data}

    X509v3 Extended Key Usage: 
        TLS Web Server Authentication

P.S. Looks like for MS this is -SmimeCapabilities attribute: https://docs.microsoft.com/en-us/powershell/module/pkiclient/new-selfsignedcertificate?view=win10-ps


regarding S/MIME Capabilities:

answer found here: http://openssl.6102.n7.nabble.com/SMIME-Capabilities-encoding-in-openssl-cnf-td24845.html

*path how to inculde SMIME-CAPS is: [ req ] section -> req_extensions = req_ext -> [ req_ext ] section -> SMIME-CAPS = ASN1:SEQUENCE:smime_seq

[ req_ext ]
SMIME-CAPS         = ASN1:SEQUENCE:smime_seq
[ smime_seq ]
capabilityID.0 = OID:sha1
capabilityID.1 = OID:sha256
capabilityID.2 = OID:sha1WithRSA
capabilityID.3 = OID:aes-256-ecb
capabilityID.4 = OID:aes-256-cbc
capabilityID.5 = OID:aes-256-ofb
capabilityID.6 = OID:aes-128-ecb
capabilityID.7 = OID:aes-128-cbc
capabilityID.8 = OID:aes-128-ecb

The additional question is:

How to read SMIME capability from certificate installed on server and transform it to OIDs like aes-128-ecb etc ?

with 'openssl s_client -connect ..' or any other.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.