Reading an "otherName" value from a "subjectAltName" certificate extension

[Dustin Oprea]

It looks like OpenSSL always shows "unsupported" for a subjectAltName of "otherName".

The string that was written (both via M2Crypto, and directly at the commandline via openssl.cnf):

    1.2.3.4;UTF8:some other identifier

Dumped (openssl x509 -in test.crt -noout -text):

                    c3:88:36:93:82:58:0c:08:7f

                Exponent: 65537 (0x10001)

        X509v3 extensions:

            X509v3 Subject Alternative Name: 

                othername:<unsupported>

    Signature Algorithm: sha1WithRSAEncryption

        05:76:d5:fc:d0:44:50:af:39:76:05:b4:cb:b6:99:9f:7c:c0:

Grepping through the OpenSSL source for "otherName", this stood out to me (in v3_alt.c):

1:

    STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,

                    GENERAL_NAME *gen, STACK_OF(CONF_VALUE) *ret)

    {

        unsigned char *p;

        char oline[256], htmp[5];

        int i;

        switch (gen->type)

        {

            case GEN_OTHERNAME:

            X509V3_add_value("othername","<unsupported>", &ret);

            break;

            case GEN_X400:

            X509V3_add_value("X400Name","<unsupported>", &ret);

            break;

            case GEN_EDIPARTY:

            X509V3_add_value("EdiPartyName","<unsupported>", &ret);

            break;

2:

    int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)

    {

        unsigned char *p;

        int i;

        switch (gen->type)

        {

            case GEN_OTHERNAME:

            BIO_printf(out, "othername:<unsupported>");

            break;

            case GEN_X400:

            BIO_printf(out, "X400Name:<unsupported>");

            break;

            case GEN_EDIPARTY:

            /* Maybe fix this: it is supported now */

            BIO_printf(out, "EdiPartyName:<unsupported>");

            break;

So, I'm willing to bet that both this and the empirical knowledge coming from my attempts above mean that I shouldn't ever expect that the "otherName" values will *ever* be properly rendered via the command-line or library calls. This might be because they're actual, encoded ASN.1 strings. So, how can I do it? How do people extract these values? If they are actual ASN.1 strings, is it up to the developer to decode them?

Dustin