Several of the OpenSSL utilities can add extensions to a certificate or certificate request based on the contents of a configuration file.
Typically the application will contain an option to point to an extension section. Each line of the extension section takes the form:
extension_name=[critical,] extension_options
If critical is present then the extension will be critical.
The format of extension_options depends on the value of extension_name.
There are four main types of extension: string extensions, multi-valued extensions, raw and arbitrary extensions.
String extensions simply have a string which contains either the value itself or how it is obtained.
For example:
nsComment="This is a Comment"
Multi-valued extensions have a short form and a long form. The short form is a list of names and values:
basicConstraints=critical,CA:true,pathlen:1
The long form allows the values to be placed in a separate section:
basicConstraints=critical,@bs_section
[bs_section]
CA=true
pathlen=1
Both forms are equivalent.
The syntax of raw extensions is governed by the extension code: it can for example contain data in multiple sections. The correct syntax to use is defined by the extension code itself: check out the certificate policies extension for an example.
If an extension type is unsupported then the arbitrary extension syntax must be used, see the ARBITRARY EXTENSIONS section for more details.