title: Extract requested validity period from a Certificate Signing Request using OpenSSL
body: <p>We use a private certificate authority powered by OpenSSL to authenticate our customers. We provide a simple web-based utility which allows them to upload a CSR file for the certificate authority to sign.</p>
  
  <p>At the moment, we can only issue certificates for a fixed period, currently 365 days. However, our customers have asked if they can specify the validity period of their certificates instead.</p>
  
  <p>I would prefer not to have to ask the user what validity period they want, since they have to specify a validity period when they generate their CSR, and it makes sense to extract this period from the CSR when signing the certificate. However I can't work out how to do it: the normal things that OpenSSL lets you do to debug CSRs, certificates and keys don't show the relevant information: here's an example of the output of "openssl req -text -noout &lt; csrfile":</p>
  
  <pre><code>$ openssl req -text -noout &lt; my.csr 
  Certificate Request:
      Data:
          Version: 0 (0x0)
          Subject: C=GB, L=London, O=example.com, CN=customer/emailAddress=ssl@example.com
          Subject Public Key Info:
              Public Key Algorithm: rsaEncryption
              RSA Public Key: (1024 bit)
                  Modulus (1024 bit):
                      00:c4:3b:11:7f:61:31:19:97:b6:26:19:01:e7:c6:
                      c3:d5:03:a5:f6:5a:4d:e2:03:d0:4e:76:49:d0:7f:
                      59:92:bf:5e:12:b3:b0:7e:20:5b:d8:a2:3f:cb:50:
                      c1:64:e5:48:04:c3:b2:04:e3:f2:4c:2f:0e:e2:a6:
                      c3:7c:36:24:dc:97:c9:f0:ba:ad:87:0f:71:45:9c:
                      6a:7f:d4:4c:d5:31:8e:49:a8:e4:3d:c4:ec:5e:54:
                      bf:f9:ba:ce:21:4c:11:15:7d:f0:d3:7a:77:f6:66:
                      5d:07:4e:4a:d3:0e:f0:52:0d:d9:cf:81:86:fe:9b:
                      c8:f8:e4:8d:d6:d1:d0:85:7f
                  Exponent: 65537 (0x10001)
          Attributes:
              a0:00
      Signature Algorithm: sha1WithRSAEncryption
          5e:4c:38:59:95:e5:11:b4:a3:d5:88:1f:3c:c0:33:67:cb:b2:
          14:85:73:c3:5a:b8:23:bf:1d:25:2b:a9:38:93:da:fb:67:17:
          26:6c:79:07:dd:7f:3c:3f:b0:33:17:d1:c2:41:f7:c9:ce:1e:
          32:1c:a1:a0:a3:50:67:56:1b:58:d9:b4:48:56:70:00:43:22:
          a9:0c:17:be:67:42:f4:98:d6:d8:c0:d0:4f:6a:73:d1:a8:57:
          91:3c:02:dc:dc:8f:e3:fb:48:28:06:a2:8e:8e:27:b2:39:d7:
          3e:ce:63:ae:66:9b:ec:38:ee:09:77:dc:0f:91:40:ab:28:0f:
          ae:a9
  </code></pre>
  
  <p>No mention of the requested validity period anywhere.</p>
  
  <p>Any suggestions?</p>