OPENSSL-NAMEDISPLAY-OPTIONS(1ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 openssl-namedisplay-options — bestie edition 🎀

okay so real talk: this is the openssl-namedisplay-options page from the OpenSSL manual, section 1ossl, and it's literally all about making Distinguished Names (DNs) look the way you want them to look. glow-up for your DNs, no cap ✨

🌸 NAME 🌸

openssl-namedisplay-options — Distinguished name display options 🫶

🦋 SYNOPSIS 🦋

openssl command [ options ... ] [ parameters ... ]

✨ DESCRIPTION ✨

OpenSSL gives you fine-grain control over how the subject and issuer DN's get displayed, and honestly? iconic behavior. 💅

You control this with the -nameopt option, which takes a comma-separated list of options from the set below. And here's the cute part: any option can be preceded by a minus sign, -, to turn it off. Turn it off!! Loved that for us. 🙈

The first four option arguments are the ones people actually use the most (the main characters, if you will 👑).

The default value is:

esc_ctrl,utf8,dump_unknown,dump_der,sep_comma_plus_space,sname

🎀 OPTIONS 🎀

🌈 Name Format Option Arguments

The DN output format can be fine-tuned with the following flags. Let's go through every single one, because we don't skip. 💖

  • compat — display the name using an old format from previous OpenSSL versions. retro vibes, vintage aesthetic, but like... old. 🕰️
  • RFC2253 — display the name using the format defined in RFC 2253. It's equivalent to esc_2253, esc_ctrl, esc_msb, utf8, dump_nostr, dump_unknown, dump_der, sep_comma_plus, dn_rev and sname. a whole bundle, a whole package deal 🎁
  • oneline — display the name in one line, using a format that is more readable than RFC 2253. It's equivalent to esc_2253, esc_ctrl, esc_msb, utf8, dump_nostr, dump_der, use_quote, sep_comma_plus_space, space_eq and sname. one line, maximum readability, slay ✨
  • multiline — display the name using multiple lines. It's equivalent to esc_ctrl, esc_msb, sep_multiline, space_eq, lname and align. giving very much "spread out and breathe" energy 🌬️
  • esc_2253 — escape the "special" characters in a field, as required by RFC 2253. That is: any of the characters ,+"<>;, # at the beginning of a string, and leading or trailing spaces. protect those special lil guys 🛡️
  • esc_2254 — escape the "special" characters in a field as required by RFC 2254 in a field. That is: the NUL character and any of ()*. different RFC, different special characters, same protective energy 💜
  • esc_ctrl — escape non-printable ASCII characters, codes less than 0x20 (space) or greater than 0x7F (DELETE). They get displayed using the RFC 2253 "\XX" notation, where XX are the two hex digits representing the character value. hex digits ate 🔥
  • esc_msb — escape any characters with the most significant bit set, that is, with values larger than 127, as described in esc_ctrl. those high-value characters get the escape treatment too 😌
  • use_quote — escapes some characters by surrounding the entire string with quotation marks, """. Without this option, individual special characters get preceded with a backslash character, "\". pick your fighter: quotes or backslashes 🥊
  • utf8 — convert all strings to UTF-8 format first, as required by RFC 2253. If the output device is UTF-8 compatible, then using this option (and not setting esc_msb) may give the correct display of multibyte characters. If this option is not set, then multibyte characters larger than 0xFF will be output as "\UXXXX" for 16 bits or "\WXXXXXXXX" for 32 bits. In addition, any UTF8Strings will be converted to their character form first. utf8 hive rise up 🧚
  • ignore_type — this option does not attempt to interpret multibyte characters in any way. That is, the content octets are merely dumped as though one octet represents each character. This is useful for diagnostic purposes but will result in rather odd looking output. ngl it's giving "I woke up and chose chaos" 💀
  • show_type — display the type of the ASN1 character string before the value, such as "BMPSTRING: Hello World". name AND value, a two-for-one 🫶
  • dump_der — any fields that would be output in hex format are displayed using the DER encoding of the field. If not set, just the content octets are displayed. Either way, the #XXXX... format of RFC 2253 is used. hex but make it DER 🔥
  • dump_nostr — dump non-character strings, such as ASN.1 OCTET STRING. If this option is not set, then non-character string types will be displayed as though each content octet represents a single character. dumping, but make it specifically the non-characters 🍓
  • dump_all — dump all fields. When this is used with dump_der, this allows the DER encoding of the structure to be unambiguously determined. unambiguously determined!! that's the whole point, bestie 🎯
  • dump_unknown — dump any field whose OID is not recognised by OpenSSL. unknown OIDs? we still dump them, we don't ignore them, we're not rude 💅
  • sep_comma_plus, sep_comma_plus_space, sep_semi_plus_space, sep_multiline — specify the field separators! The first word is used between the Relative Distinguished Names (RDNs) and the second is between multiple Attribute Value Assertions (AVAs). Multiple AVAs are very rare and their use is discouraged. The options ending in "space" additionally place a space after the separator to make it more readable. The sep_multiline starts each field on its own line, and uses "plus space" for the AVA separator. It also indents the fields by four characters. The default value is sep_comma_plus_space. separators, but make them aesthetic ✨
  • dn_rev — reverse the fields of the DN as required by RFC 2253. This also reverses the order of multiple AVAs in a field, but this is permissible as there is no ordering on values. reverse, reverse! 🔄
  • nofname, sname, lname, oid — specify how the field name is displayed. nofname does not display the field at all. sname uses the "short name" form (e.g. CN for commonName). lname uses the long form. oid represents the OID in numerical form and is useful for diagnostic purposes. four whole personality types for displaying a name, pick your vibe 👑
  • align — align field values for a more readable output. Only usable with sep_multiline. ⚠️ align slaps but she needs sep_multiline, that's her emotional support option 💖
  • space_eq — places spaces round the equal sign, "=", character which follows the field name. breathing room around the = 🫧

Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>. like, legally, read the license, bestie 🫶

okay and that's the whole page!! this was OpenSSL 3.5.0, dated 2026-09-25 — mwah, thanks for reading, love u, bye!! 💖✨🎀🦋

📦 where this page comes from