title: openssl ca vs openssl x509 (the openssl ca command doesn't register the same on certificate?)
body: <p>what is the difference between <code>openssl ca</code> and <code>openssl x509</code> commands? I'm using it to create and sign my root-ca, intermed-ca and clients certificates, but the <code>openssl ca</code> command does not register the cellphone and emailAddress on the certificates while <code>openssl x509</code> does. </p>
  
  <p><strong>openssl x509:</strong></p>
  
  <pre><code>openssl x509 -req \
  -in client.req.pem \
  -out client.cert.pem -signkey client.privkey.pem \
  -CA ca.cert.pem -CAkey ca.key.pem -CAcreateserial -days 365
  </code></pre>
  
  <p><strong>openssl ca:</strong></p>
  
  <pre><code>openssl ca \
  -in client.req.pem \
  -out client.cert.pem \
  -extensions client_ext \
  -startdate `date +%y%m%d000000Z -u -d -2day` \
  -enddate `date +%y%m%d000000Z -u -d +1years+1day`
  </code></pre>
  
  <p><strong>My ca.cnf</strong></p>
  
  <pre><code>CA_HOME                 = .
  RANDFILE                = $ENV::CA_HOME/private/.rnd
  #oid_section             = new_oids
  
  # XMPP address Support
  #[ new_oids ]
  #xmppAddr          = 1.3.6.1.5.5.7.8.5
  #dnsSRV            = 1.3.6.1.5.5.7.8.7
  
  # Default Certification Authority
  [ ca ]
  default_ca              = intermed_ca
  
  # Intermediate Certification Authority
  [ intermed_ca ]
  dir                     = $ENV::CA_HOME
  certs                   = $dir/certs
  serial                  = $dir/intermed-ca.serial
  database                = $dir/intermed-ca.index
  new_certs_dir           = $dir/newcerts
  certificate             = $dir/intermed-ca.cert.pem
  private_key             = $dir/private/intermed-ca.key.pem
  default_days            = 730 # Two years
  crl                     = $dir/crl/intermed-ca.crl
  crl_dir                 = $dir/crl
  crlnumber               = $dir/intermed-ca.crlnum
  name_opt                = multiline, align
  cert_opt                = no_pubkey
  copy_extensions         = copy
  crl_extensions          = crl_ext
  default_crl_days        = 30
  default_md              = sha256
  preserve                = no
  email_in_dn             = no
  policy                  = policy
  unique_subject          = no
  
  #
  # Distinguished Name Policy
  [ policy ]
  countryName             = optional
  stateOrProvinceName     = optional
  localityName            = optional
  organizationName        = optional
  organizationalUnitName  = optional
  commonName              = supplied
  
  #
  # Distinguished Name Policy for Personal Certificates
  [ user_policy ]
  countryName             = supplied
  stateOrProvinceName     = optional
  localityName            = supplied
  organizationName        = optional
  organizationalUnitName  = optional
  commonName              = supplied
  emailAddress            = supplied
  #xmppAddr               = optional # Added to SubjAltName by req
  
  #
  # Intermediate CA request options
  [ req ]
  default_bits            = 3072
  default_keyfile         = private/intermed-ca.key.pem
  encrypt_key             = yes
  default_md              = sha256
  string_mask             = utf8only
  utf8                    = yes
  prompt                  = no
  req_extensions          = req_ext
  distinguished_name      = distinguished_name
  subjectAltName          = subject_alt_name
  
  #
  # Intermediate CA Request Extensions
  [ req_ext ]
  subjectKeyIdentifier    = hash
  subjectAltName          = @subject_alt_name
  
  #
  # Distinguished Name (DN)
  [ distinguished_name ]
  countryName             = BR
  stateOrProvinceName     = mystate
  localityName            = mycity
  organizationName        = domain.com
  organizationalUnitName  = P&amp;D
  commonName              = domain.com.br Intermediate Certification Authority
  emailAddress            = my.email@domain.com
  
  #
  # Server Certificate Extensions
  [ server_ext ]
  basicConstraints        = CA:FALSE
  keyUsage                = critical, digitalSignature, keyEncipherment
  extendedKeyUsage        = critical, serverAuth, clientAuth
  subjectKeyIdentifier    = hash
  authorityKeyIdentifier  = keyid:always
  issuerAltName           = issuer:copy
  authorityInfoAccess     = @auth_info_access
  crlDistributionPoints   = crl_dist
  
  #
  # Client Certificate Extensions
  [ client_ext ]
  basicConstraints        = CA:FALSE
  keyUsage                = critical, digitalSignature
  extendedKeyUsage        = critical, clientAuth
  subjectKeyIdentifier    = hash
  authorityKeyIdentifier  = keyid:always
  issuerAltName           = issuer:copy
  authorityInfoAccess     = @auth_info_access
  crlDistributionPoints   = crl_dist
  
  #
  # User Certificate Extensions
  [ user_ext ]
  basicConstraints        = CA:FALSE
  keyUsage                = critical, digitalSignature
  extendedKeyUsage        = critical, clientAuth, emailProtection
  subjectKeyIdentifier    = hash
  authorityKeyIdentifier  = keyid:always
  issuerAltName           = issuer:copy
  authorityInfoAccess     = @auth_info_access
  crlDistributionPoints   = crl_dist
  
  #
  # CRL Certificate Extensions
  [ crl_ext ]
  authorityKeyIdentifier  = keyid:always
  issuerAltName           = issuer:copy
  
  #
  # Certificate Authorities Alternative Names
  [ subject_alt_name ]
  URI                     = http://ca.domain.com/
  email                   = contato@domain.com
  
  #
  # Certificate download addresses for the intermediate CA
  [ auth_info_access ]
  caIssuers;URI           = http://ca.domain.com/certs/domain.com_Intermediate_Certification_Authority.cert.pem
  
  #
  # CRL Download address for the intermediate CA
  [ crl_dist ]
  fullname                = URI:http://ca.domain.com/crl/domain.com_Intermediate_Certification_Authority.crl
  </code></pre>
  
  <p><strong>Reference</strong></p>
  
  <p><a href="https://roll.urown.net/ca/ca_root_setup.html" rel="nofollow noreferrer">https://roll.urown.net/ca/ca_root_setup.html</a></p>