Take the 2-minute tour ×

We use a private certificate authority powered by OpenSSL to authenticate our customers. We provide a simple web-based utility which allows them to upload a CSR file for the certificate authority to sign.

At the moment, we can only issue certificates for a fixed period, currently 365 days. However, our customers have asked if they can specify the validity period of their certificates instead.

I would prefer not to have to ask the user what validity period they want, since they have to specify a validity period when they generate their CSR, and it makes sense to extract this period from the CSR when signing the certificate. However I can't work out how to do it: the normal things that OpenSSL lets you do to debug CSRs, certificates and keys don't show the relevant information: here's an example of the output of "openssl req -text -noout < csrfile":

$ openssl req -text -noout < my.csr 
Certificate Request:
        Version: 0 (0x0)
        Subject: C=GB, L=London, O=example.com, CN=customer/emailAddress=ssl@example.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha1WithRSAEncryption

No mention of the requested validity period anywhere.

Any suggestions?

share|improve this question
add comment

3 Answers

I've been trying to figure out how to request a specific validity period in a CSR, and as far as I can tell, the CSR simply doesn't carry that information. The CSR's structure is defined in PKCS#10 / RFC2986, and it doesn't have a field specifically for a requested validity period. The attributes and extensions that can be put in the CSR are listed in PKCS#9, and there's nothing there about validity periods. And finally, I can do a openssl asn1parse on my generated CSRs and find that there's no validity-period-related information included regardless of what I pass to openssl req.

share|improve this answer
add comment

Though you request for a certain validity period for your certificate, while generating the CSR, its uncertain to expect that validity to be acceptable by CA. Most CA's would prefer a predefined validity period and few CA's are OK with the requested validity period and generate the CSR accordingly. Now coming to the point, the CSR ASN.1 structure according to PKCS#10 standard does not specify the validity period. And thus you cannot extract that information from the CSR.

share|improve this answer
add comment

Try to add -days xx parameter to your request creation command

share|improve this answer
Dmitry: your comment doesn't quite answer my question: I already know how to use -days when generating a CSR, and also how to use it when issuing a certificate. What I want to know is how to extract the value for -days that was used when the CSR was generated. –  Gavin Brown Apr 7 '09 at 9:51
add comment

Your Answer


