title: How to add custom field to certificate using openssl
body: <p>I'm trying to create certificates for internal use. I'm the CA and I would like to have an additional field in my client certificates so that when I generate a certificate for a client, it will hold some specific data in that field.</p>
  
  <p>I read the following <a href="https://www.openssl.org/docs/manmaster/apps/x509v3_config.html" rel="noreferrer">article</a> and <a href="http://the.randomengineer.com/2014/04/18/adding-custom-data-to-x-509-ssl-certificates/" rel="noreferrer">another article</a> and I understand that I can do that with x509 v3 format by generating an oid for each field, and then use it with the <code>-extfile</code> parameter when creating the public key
  so I took the deafult /etc/ssl/openssl.cnf config file and uncomment one of the mentioned fields:</p>
  
  <pre><code>[ new_oids ]
  testoid1 = 1.2.3.4
  </code></pre>
  
  <p>Then I generate all the certificates by the following:</p>
  
  <pre><code>openssl genrsa -aes256 -out ca-key.pem 4096
  openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem -config openssl.cnf 
  openssl genrsa -out key.pem 4096
  openssl req -subj '/CN=client' -new -key key.pem -out client.csr
  openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem  -CAcreateserial -out cert.pem -extfile extfile.cnf
  </code></pre>
  
  <p>Where extfile.cnf content is:</p>
  
  <pre><code>1.2.3.4 = Something
  </code></pre>
  
  <p>I get:</p>
  
  <pre><code>Error Loading extension section default
  140218200073872:error:22097082:X509 V3 routines:DO_EXT_NCONF:unknown extension name:v3_conf.c:125:
  140218200073872:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension:v3_conf.c:95:name=1.2.3.4, value=Something
  unable to write 'random state'
  </code></pre>
  
  <p>Documentation in this topic is lacking. Can someone walk me through it and explain how it can be done?</p>