All the answers can be found in RFC 5280 which defines the X.509 certificate format.
1. What does req_distinguished_name
mean and how is this being used?
It looks like OpenSSL is spitting this out in .ini
format, so I would guess that
distinguished_name = req_distinguished_name
means that the required distinguished name info can be found in tho[req_distinguished_name]
section below. Similarly,
x509_extensions = v3_ca
means that the extension stuff can be found in the [v3_ca]
section.
In X.509, a Distinguished Name (DN) is a unique identifier for the person or server who holds this certificate. DNs are structured much the same as a domain name in a URL starting with a country code, and going right down to the name of the person or server.
2. What do critical and pathlen mean in basicContraints? basicConstraints = critical, CA:TRUE, pathlen:1
RFC 5280 Section 4.2.1.9. Basic Constraints says:
The basic constraints extension identifies whether the subject of the
certificate is a CA and the maximum depth of valid certification
paths that include this certificate.
So CA:TRUE, pathlen:1
means that this is a self-signed root CA and it can only issue end-user certs not subordinate CAs, since any certs they issue would have a pathlen > 1.
3. What does critical mean in X.509 certificates?
RFC 5280 Section 4.2. Certificate Extensions says:
Each extension in a
certificate is designated as either critical or non-critical. A
certificate-using system MUST reject the certificate if it encounters
a critical extension it does not recognize or a critical extension
that contains information that it cannot process. A non-critical
extension MAY be ignored if it is not recognized, but MUST be
processed if it is recognized.
So basically, critical
means that errors in this data should be considered fatal, non-critical means that errors can be ignored.
req
for DISTINGUISHED NAME and the manpage forx509v3_config
for all extensions including basicconstraints and keyusage. The manpages should be present on your system if Unixy, and are also online at openssl.org/docs/manpages.html . $\endgroup$