OPENSSL-NAMEDISPLAY-OPTIONS(1ossl)

📦
version 15.1 · 2 versions
, in freebsd 15.1

💅 OPENSSL-NAMEDISPLAY-OPTIONS (1ossl) 💅

okay so bestie, welcome to the glow-up guide for openssl-namedisplay-options — the OpenSSL manual page that teaches you how to make Distinguished Names (DNs) look exactly how you want them to look. no cap, this one's a vibe. 🎀

✨ NAME ✨

openssl-namedisplay-options — Distinguished name display options. literally what it says on the tin. 💖

🌸 SYNOPSIS 🌸

openssl command [ options ... ] [ parameters ... ]

🦋 DESCRIPTION 🦋

OpenSSL gives you fine-grain control over how the subject and issuer DNs get displayed — like, actually fine-grained, we're talking microscopic levels of control here. 👑

You tell it what you want with the -nameopt option, which takes a comma-separated list of options picked from the set down below. And here's the cute part: any option can be preceded by a minus sign, -, to turn it off. So you can just say "no thank you" to any of them. 🙅‍♀️

The first four option arguments are the most commonly used ones — the main characters, iykyk. ⭐

The default value is:

"esc_ctrl,utf8,dump_unknown,dump_der,sep_comma_plus_space,sname"

so that's the fit it ships with before you start customising. 💜

🔥 OPTIONS 🔥

🧚 Name Format Option Arguments 🧚

The DN output format can be fine tuned with the following flags — go off, customise your little heart out. 💅

  • compat — Displays the name using an old format from previous OpenSSL versions. vintage. nostalgic. a throwback era. 🕰️
  • RFC2253 — Displays the name using the format defined in RFC 2253. It's equivalent to esc_2253, esc_ctrl, esc_msb, utf8, dump_nostr, dump_unknown, dump_der, sep_comma_plus, dn_rev and sname — that's the whole bundle, one click, slay. 🛍️
  • oneline — Displays the name on one line, using a format that's more readable than RFC 2253. It's equivalent to esc_2253, esc_ctrl, esc_msb, utf8, dump_nostr, dump_der, use_quote, sep_comma_plus_space, space_eq and sname. one line. one vibe. ✨
  • multiline — Displays the name using multiple lines. It's equivalent to esc_ctrl, esc_msb, sep_multiline, space_eq, lname and align. give it room to breathe, bestie. 🌬️
  • esc_2253 — Escapes the "special" characters in a field, as required by RFC 2253. That means any of the characters , + " < > ;, plus # when it's at the beginning of a string, plus leading or trailing spaces. those ones get the backslash treatment. 🪄
  • esc_2254 — Escapes the "special" characters in a field as required by RFC 2254. That's the NUL character and any of ( ) *. 🧼
  • esc_ctrl — Escapes non-printable ASCII characters — codes less than 0x20 (space) or greater than 0x7F (DELETE). They're displayed using RFC 2253's \XX notation, where XX are the two hex digits representing the character value. hex girlies rise. 🔢
  • esc_msb — Escapes any characters with the most significant bit set, i.e. with values larger than 127, as described in esc_ctrl. 💯
  • use_quote — Escapes some characters by surrounding the entire string with quotation marks, ". Without this option, individual special characters get preceded with a backslash character, \. two aesthetics, pick your fighter. ⚔️
  • utf8 — Converts all strings to UTF-8 format first, as required by RFC 2253. If your output device is UTF-8 compatible, using this option (and not setting esc_msb) may give you the correct display of multibyte characters. 🦋 If this option isn't set, then multibyte characters larger than 0xFF will be output as \UXXXX for 16 bits or \WXXXXXXXX for 32 bits. Also — any UTF8Strings get converted to their character form first. 💖
  • ignore_type — This option doesn't attempt to interpret multibyte characters in any way. The content octets are merely dumped as though one octet represents each character. Useful for diagnostic purposes, but ngl the output is gonna look rather odd. 🙈
  • show_type — Displays the type of the ASN1 character string before the value, like BMPSTRING: Hello World. label girlies, this one's for you. 🏷️
  • dump_der — Any fields that would be output in hex format are displayed using the DER encoding of the field. If it's not set, just the content octets are displayed. Either way, the #XXXX... format of RFC 2253 is used. 🧬
  • dump_nostr — Dumps non-character strings, such as ASN.1 OCTET STRING. If this option isn't set, then non-character string types get displayed as though each content octet represents a single character. 👀
  • dump_all — Dumps all fields. When this is used with dump_der, it allows the DER encoding of the structure to be unambiguously determined. all of it. every last crumb. 🍽️
  • dump_unknown — Dumps any field whose OID isn't recognised by OpenSSL. we don't know her but we support her. 💅
  • sep_comma_plus, sep_comma_plus_space, sep_semi_plus_space, sep_multiline — These specify the field separators! The first word is used between the Relative Distinguished Names (RDNs) and the second is between multiple Attribute Value Assertions (AVAs). Multiple AVAs are very rare and their use is discouraged. 🚨 The options ending in space additionally place a space after the separator to make it more readable. sep_multiline starts each field on its own line and uses "plus space" for the AVA separator — it also indents the fields by four characters. The default value is sep_comma_plus_space. 📏
  • dn_rev — Reverses the fields of the DN as required by RFC 2253. This also reverses the order of multiple AVAs in a field, but that's permissible since there's no ordering on values. 🔄
  • nofname, sname, lname, oid — These specify how the field name is displayed. nofname doesn't display the field at all (ghosting it, respectfully). sname uses the "short name" form (so CN instead of commonName, for example). lname uses the long form. oid represents the OID in numerical form and is useful for diagnostic purposes. 🔍
  • align — Aligns field values for a more readable output. Only usable with sep_multiline — that's the rules, babe. 📐
  • space_eq — Places spaces round the equal sign, =, character which follows the field name. symmetrical. balanced. aesthetic. ⚖️

Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie — mwah 💋

shoutout to OpenSSL 3.5.6, dated 2026-04-07, for sponsoring this entire moment. 🫶✨💖

📦 where this page comes from