I can create a self signed certificate using openSSL as follows:

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days XXX -nodes

The interface somehow restricts me to 64 bytes for the common name. How can I create a certificate that has a common name longer than 64 bytes?


In my case, all the answers of "don't do this, it's against standards" were very unhelpful since I needed to do this as part of a reverse engineering challenge. In my case, the fact that it was against the standards didn't matter whatsoever.

Here are the (rough) steps:

  1. Download the latest source of libressl from https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/ (I used 2.6.0 because it's the version that ships on macOS Mojave)
  2. Unzip/tar/gz and then open /crypto/asn1/a_mbstr.c in your favorite editor
  3. Search for something that looks like the following:

    if ((maxsize > 0) && (nchar > maxsize)) {
        ERR_asprintf_error_data("maxsize=%ld", maxsize);
        return -1;

    and comment it out. For version 2.6.0, this was on lines 155-159. By removing these lines, you are removing the max CN length check.

  4. Follow the directions in the README file to build the binary. I didn't need to install any libraries when I built on macOS but YMMV. I used cmake which dropped the new openssl binary in /build/apps/openssl

  5. Generate a CSR using the command line flags (read: NOT THE INTERACTIVE TOOL -- it has a special check that is not patched out by this modification!).

    For example:

    /build/apps/openssl/openssl req -new -newkey rsa:2048 -nodes -out a.csr -keyout a.key -subj "/CN=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
  6. Using the stock openssl binaries (or the modified ones, if you want), sign the CSR:

    openssl x509 -req -in a.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out a.crt -days 500 -sha256

After that, you should have your wonderful non-compliant certificate ready to use. I have noticed quite a few issues with using certificates with CNs longer than 64 characters (Wireshark truncates the CN in the disector display, etc) but it does in fact work for what I needed.


You can't.

The specified max limit is 64:

-- specifications of Upper Bounds MUST be regarded as mandatory

-- from Annex B of ITU-T X.411 Reference Definition of MTS Parameter

-- Upper Bounds

-- Upper Bounds

ub-name INTEGER ::= 32768

ub-common-name INTEGER ::= 64

ub-locality-name INTEGER ::= 128

ub-state-name INTEGER ::= 128

ub-organization-name INTEGER ::= 64

  • 1
    what if I do not care about the validity of the certificate and I just need it for testing? i believe I would have to manually edit the certificate in this case – SivaDotRender Oct 6 '15 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.