Take the 2-minute tour ×  We use a private certificate authority
powered by OpenSSL to authenticate our customers. We provide a
simple web-based utility which allows them to upload a CSR file
for the certificate authority to sign.  At the moment, we can
only issue certificates for a fixed period, currently 365 days.
However, our customers have asked if they can specify the
validity period of their certificates instead.  I would prefer
not to have to ask the user what validity period they want,
since they have to specify a validity period when they generate
their CSR, and it makes sense to extract this period from the
CSR when signing the certificate. However I can't work out how
to do it: the normal things that OpenSSL lets you do to debug
CSRs, certificates and keys don't show the relevant information:
here's an example of the output of "openssl req -text -noout <
csrfile":  $ openssl req -text -noout < my.csr  Certificate
Request:         Version: 0 (0x0)         Subject: C=GB,
L=London, O=example.com, CN=c