Subject: [pkix] Question about the "Name Constraints" extension in OpenSSL

From: "[email-masked]" <[email-masked]>
Date: Thu, 10 May 2012 15:56:20 -0400 (EDT)

Hi All,
I am sorry to bother you but I am kind of stuck in how to setup the
minimum and/or maximum for "Name Constraints" in OpenSSL mentioned in this
document RFC 5280 <http://datatracker.ietf.org/doc/rfc5280/?include_text=1>
, paragraph " 4.2.1.10. Name Constraints "

I looked over the net but I couldn't find any thing about the syntax that I
can use in openssl config file:
I have the following setup but I need to set the minimum to 0 and I don't
know the syntax. Everything I tried failed.

nameConstraints = critical, excluded;URI:.mydomain.com;DNS:mydomain.com

Can you please help or can you point me to some one who can help?

Thank you very much
Housseine

---

From: Erwann Abalea <[email-masked]>
Date: Fri, 11 May 2012 00:48:01 +0200

2012/5/10 [email-masked] <[email-masked]>

> **
>
>    Hi All,
>
> I am sorry to bother you but I am kind of stuck in how to setup the *
> minimum* and/or *maximum* for "Name Constraints" in OpenSSL mentioned in
> this document RFC 5280<http://datatracker.ietf.org/doc/rfc5280/?include_text=1>, paragraph "
> * 4.2.1.10. Name Constraints * "
>
>
> I looked over the net but I couldn't find any thing about the syntax that
> I can use in openssl config file:
>
>  *nameConstraints = critical, excluded;URI:.mydomain.com;DNS:mydomain.com
> *
>
>

openssl-users at openssl.org

But I think the minimum is already set to 0 by default, and the maximum
omitted.
If you don't see the "minimum" value when decoding the extension, then it
means its value is 0 (which is the default, so it's not encoded in DER).

-- 
Erwann.

---

From: Housseine Rejouan <[email-masked]>
Date: Thu, 10 May 2012 20:38:35 -0700

Hi Erwann,
Thank you for your prompt response. Yes, you are right the default value 
is set to 0.
I am looking also to be able to set this in future to any value we need to.
It should be a way to set it up in the openssl configuration file. and 
that's what I am looking for.
Thank you
Housseine

On 5/10/12 3:48 PM, Erwann Abalea wrote:
>
> 2012/5/10 [email-masked] <mailto:[email-masked]> 
> <[email-masked] <mailto:[email-masked]>>
>
>     Hi All,
>
>     I am sorry to bother you but I am kind of stuck in how to setup
>     the *minimum* and/or *maximum* for "Name Constraints" in OpenSSL
>     mentioned in this document RFC 5280
>     <http://datatracker.ietf.org/doc/rfc5280/?include_text=1> ,
>     paragraph " *4.2.1.10. Name Constraints * "
>
>
>     I looked over the net but I couldn't find any thing about the
>     syntax that I can use in openssl config file:
>
>     I have the following setup but I need to set the minimum to 0 and
>     I don't know the syntax. Everything I tried failed.
>
>
>     *nameConstraints = critical, excluded;URI:.mydomain.com
>     <http://mydomain.com>;DNS:mydomain.com <http://mydomain.com> *
>
>
> openssl-users at openssl.org <http://openssl.org>
>
> But I think the minimum is already set to 0 by default, and the 
> maximum omitted.
> If you don't see the "minimum" value when decoding the extension, then 
> it means its value is 0 (which is the default, so it's not encoded in 
> DER).
>
> -- 
> Erwann.

---

From: Erwann Abalea <[email-masked]>
Date: Fri, 11 May 2012 10:07:22 +0200

Bonjour,

2012/5/11 Housseine Rejouan <[email-masked]>

> Thank you for your prompt response. Yes, you are right the default value

You really should ask this question to the right mailing list, as indicated
in my answer: openssl-users at openssl.org.

> that's what I am looking for.

Reading OpenSSL 1.0.0e source code tells me the minimum and maximum values
can't be set by configuration file.
OpenSSL, when asked to verify a certificate, will even stop with an error
if minimum or maximum are set.

Minimum and maximum values are useless for your examples (dnsName and
emailAddress), as they only apply to "The Great Directory" proposed by
X.500, and don't fit at all with IETF's view of the world.
More, since PKIX states that minimum MUST be zero and maximum MUST be
absent, asking in this mailing list how to set different values for a
non-IETF product is awkward.

-- 
Erwann.