OPENSSL-NAMEDISPLAY-OPTIONS(1ossl)

🎀 openssl-namedisplay-options 🎀

💖 NAME 💖

openssl-namedisplay-options — Distinguished name display options. This is the 1ossl manual, bestie, and it’s all about how OpenSSL shows off subject and issuer DNs. 💅

✨ SYNOPSIS ✨

openssl command [ options ... ] [ parameters ... ]

🌸 DESCRIPTION 🌸

Okay so OpenSSL provides fine-grain control over how the subject and issuer DN’s are displayed. This is specified by using the -nameopt option, which takes a comma-separated list of options from the following set. An option may be preceded by a minus sign, -, to turn it off. The first four option arguments are the most commonly used. Main character options, tbh. 👑

The default value is:

esc_ctrl,utf8,dump_unknown,dump_der,sep_comma_plus_space,sname

💫 OPTIONS 💫

🦋 Name Format Option Arguments 🦋

The DN output format can be fine tuned with the following flags. Let’s get into it. 💖

• compat — Display the name using an old format from previous OpenSSL versions. Vintage vibes, but make it compatibility. 👑
• RFC2253 — Display the name using the format defined in RFC 2253. It is equivalent to esc_2253, esc_ctrl, esc_msb, utf8, dump_nostr, dump_unknown, dump_der, sep_comma_plus, dn_rev and sname. Absolute classic, no cap. 📜
• oneline — Display the name in one line, using a format that is more readable RFC 2253. It is equivalent to esc_2253, esc_ctrl, esc_msb, utf8, dump_nostr, dump_der, use_quote, sep_comma_plus_space, space_eq and sname options. One-line slay. ✨
• multiline — Display the name using multiple lines. It is equivalent to esc_ctrl, esc_msb, sep_multiline, space_eq, lname and align options. Multi-line main character energy. 📚
• esc_2253 — Escape the "special" characters in a field, as required by RFC 2253. That is, any of the characters ",+"<>;", "#" at the beginning of a string and leading or trailing spaces. Escaping tea, served fresh. ☕
• esc_2254 — Escape the "special" characters in a field as required by RFC 2254 in a field. That is, the NUL character and of "()*". Niche but valid. 🫶
• esc_ctrl — Escape non-printable ASCII characters, codes less than 0x20 (space) or greater than 0x7F (DELETE). They are displayed using RFC 2253 "\XX" notation where XX are the two hex digits representing the character value. Bye invisible gremlins. 👻
• esc_msb — Escape any characters with the most significant bit set, that is with values larger than 127, as described in esc_ctrl. Big-bit energy handled. 🔥
• use_quote — Escapes some characters by surrounding the entire string with quotation marks, ". Without this option, individual special characters are preceded with a backslash character, \. Quote it or slash it, bestie. 🎀
• utf8 — Convert all strings to UTF-8 format first as required by RFC 2253. If the output device is UTF-8 compatible, then using this option (and not setting esc_msb) may give the correct display of multibyte characters. If this option is not set, then multibyte characters larger than 0xFF will be output as \UXXXX for 16 bits or \WXXXXXXXX for 32 bits. In addition, any UTF8Strings will be converted to their character form first. UTF-8 girlies rise. 🌈
• ignore_type — This option does not attempt to interpret multibyte characters in any way. That is, the content octets are merely dumped as though one octet represents each character. This is useful for diagnostic purposes but will result in rather odd looking output. Chaotic diagnostic vibes, but valid. 💀
• show_type — Display the type of the ASN1 character string before the value, such as BMPSTRING: Hello World. Name tag moment. 🏷️
• dump_der — Any fields that would be output in hex format are displayed using the DER encoding of the field. If not set, just the content octets are displayed. Either way, the #XXXX... format of RFC 2253 is used. DER details, periodt. 🧚
• dump_nostr — Dump non-character strings, such as ASN.1 OCTET STRING. If this option is not set, then non character string types will be displayed as though each content octet represents a single character. Non-character strings get their moment. ✨
• dump_all — Dump all fields. When this used with dump_der, this allows the DER encoding of the structure to be unambiguously determined. All the fields, all the clarity. 👑
• dump_unknown — Dump any field whose OID is not recognised by OpenSSL. Unknown OIDs don’t get ignored on our watch. 🙈

Okay, the separator squad: sep_comma_plus, sep_comma_plus_space, sep_semi_plus_space, and sep_multiline all specify the field separators. The first word is used between the Relative Distinguished Names (RDNs) and the second is between multiple Attribute Value Assertions (AVAs). Multiple AVAs are very rare and their use is discouraged. The options ending in space additionally place a space after the separator to make it more readable. sep_multiline starts each field on its own line, and uses plus space for the AVA separator. It also indents the fields by four characters. The default value is sep_comma_plus_space.

• sep_comma_plus — field separator option from the squad above. Comma-plus combo. 🫶
• sep_comma_plus_space — field separator option from the squad above; this is the default. Default queen. 👑
• sep_semi_plus_space — field separator option from the squad above. Semi-plus space moment. 🌸
• sep_multiline — field separator option from the squad above. Every field on its own line, with four-character indent energy. 📚
• dn_rev — Reverse the fields of the DN as required by RFC 2253. This also reverses the order of multiple AVAs in a field, but this is permissible as there is no ordering on values. Reverse it, it’s valid. 🔄

Field-name display squad, assemble: these options specify how the field name is displayed. 🫶

• nofname — Does not display the field at all. Ghost mode. 👻
• sname — Uses the "short name" form (CN for commonName for example). Short and sweet. 🎀
• lname — Uses the long form. Full-name energy. ✨
• oid — Represents the OID in numerical form and is useful for diagnostic purpose. Numbers don’t lie. 🔢
• align — Align field values for a more readable output. Only usable with sep_multiline. Alignment is self-care. 💅
• space_eq — Places spaces round the equal sign, =, character which follows the field name. Spaces around the =: tiny but iconic. ✨

📜 COPYRIGHT 📜

Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

mwah 💋 this page is OpenSSL 3.5.9, dated 2026-09-29, from the 1ossl manual — byeee bestie 🫶✨