Generating SMIME certificate with several identities

mackowiakp · 12-14-2015, 12:38 AM

I created for Company I am working for, own CA for several purposes. One of them is generating SMIME certificates for email signing/encryption. I use such certificates on different platforms like Linux (most common), Apple Mail, WIN, Android etc.
Practically all people in Company, have several email accounts. Most of people use Thunderbird as email client. Because of TB bug it is not possible to import more than one individual certificate. So it is possible to install individual certificate for only one identity that is one email address. Googled workarounds, including TB Add-On`s - does not work.
Using OpenPGP it is possible to assign one certificate to several identities/email address. As far as I know, some payed SMIME certificate providers offers SMIME certs with several identities.

So, how can I generate one SMIME certificate with several identities/email address ?

Below script I use to generate individual SMIME certs, signed by our own CA. I know from Mageia forum, that is something like "SubjectAltName" in cert. How should I modify script below to generate one cert with several "Alt" identities?

Code:

    #!/bin/bash
    dir="/home/maciek/Dokumenty/SMIME"
    cd $dir
    echo "Generowanie certyfikatu osobistego"
    echo
    openssl genrsa -des3 -out humble_coder.key 4096
    openssl req -new -key humble_coder.key -out humble_coder.csr
    echo "Podpisanie certyfikatu osobistego przez CA"
    echo
    openssl x509 -req -days 3650 -in humble_coder.csr -CA ca.crt -CAkey ca.key -set_serial 1 -out humble_coder.crt -setalias "Certyfikat wydany przez EPI" -addtrust emailProtection -addreject clientAuth -addreject serverAuth -trustout
    echo "Konwersja certyfikatu na p12"
    echo
    openssl pkcs12 -export -in humble_coder.crt -inkey humble_coder.key -out humble_coder.p12
    echo
    echo "Jak ma si nazywa certyfikat?"
    read name
    mv -f ./humble_coder.p12 $name.p12
    rm -f ./humble_coder*

sag47 · 12-16-2015, 02:34 AM

Make use of subject alternative names. You'll likely want to make use of a more advanced script for generating certificates which uses the -subj argument.

e.g. if I have three emails: user1@example.com, user2@example.com, and user3@example.com then...

Code:

my_email="user1@example.com"
alt_emails="email:copy,email:user2@example.com,email:user3@example.com"
openssl req -new -key myname.key -sha256 -nodes
  -subj "/C=US/ST=New York/L=New York/O=Example Org/OU=Example Team/CN=${my_email}/
         emailAddress=admin@example.com/
         subjectAltName=${alt_emails}" > user.csr

Note: the -subj should be a single line with no newlines but I created newlines for readability.

One could have fancier logic but I'm lazy at the moment to create something more advanced. I haven't tested this myself because I don't normally generate client certificates. The documentation points to being able to do what I describe.

You might have to use email.1=user2@example.com,email.2=user3@example.com instead.

Sources:

My own scripts
Client certificate automation scripts
Subject Alternative Names using -subj
Subject Alternative Names openssl documentation
"man req" manual page.

mackowiakp · 12-16-2015, 03:32 AM

Thanks!

So I created script named gen (below) with necessary changes.

Code:

[maciek@piotr SMIME]$ cat gen
#!/bin/bash
my_email="user@op.pl"
alt_emails="email:copy,email:user@gmail.com,email:user@linux.pl"
openssl req -new -key humble_coder.key -nodes -subj "/C=PL/ST=pomorskie/L=Gdynia/O=EPI/OU=IT/CN=${my_email} emailAddress=user@op.pl subjectAltName=${alt_emails}" > humble_coder.csr

Than I run such commands:

Code:

[maciek@piotr SMIME]$ openssl genrsa -des3 -out humble_coder.key 4096
Generating RSA private key, 4096 bit long modulus
......................++
......................................................++
e is 65537 (0x10001)
Enter pass phrase for humble_coder.key:
Verifying - Enter pass phrase for humble_coder.key:
[maciek@piotr SMIME]$ ./gen
Enter pass phrase for humble_coder.key:
problems making Certificate Request
140620552824464:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:158:maxsize=64

As You can see, an error occur. I try to limit additional email address to only one, but result was thae same.
Any idea what I am doing wrong?