All the answers can be found in RFC 5280 which defines the X.509 certificate format.
1. What does
req_distinguished_name mean and how is this being used?
It looks like OpenSSL is spitting this out in
.ini format, so I would guess that
distinguished_name = req_distinguished_name
means that the required distinguished name info can be found in tho
[req_distinguished_name] section below. Similarly,
x509_extensions = v3_ca
means that the extension stuff can be found in the
In X.509, a Distinguished Name (DN) is a unique identifier for the person or server who holds this certificate. DNs are structured much the same as a domain name in a URL starting with a country code, and going right down to the name of the person or server.
2. What do critical and pathlen mean in basicContraints?
basicConstraints = critical, CA:TRUE, pathlen:1
RFC 5280 Section 18.104.22.168. Basic Constraints says:
The basic constraints extension identifies whether the subject of the
certificate is a CA and the maximum depth of valid certification
paths that include this certificate.
CA:TRUE, pathlen:1 means that this is a self-signed root CA and it can only issue end-user certs not subordinate CAs, since any certs they issue would have a pathlen > 1.
3. What does critical mean in X.509 certificates?
RFC 5280 Section 4.2. Certificate Extensions says:
Each extension in a
certificate is designated as either critical or non-critical. A
certificate-using system MUST reject the certificate if it encounters
a critical extension it does not recognize or a critical extension
that contains information that it cannot process. A non-critical
extension MAY be ignored if it is not recognized, but MUST be
processed if it is recognized.
critical means that errors in this data should be considered fatal, non-critical means that errors can be ignored.