OPENSSL-NAMEDISPLAY-OPTIONS(1SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 OPENSSL-NAMEDISPLAY-OPTIONS 💖

okay bestie so this is the manual page for openssl-namedisplay-options in the OpenSSL docs, and it's genuinely one of those little pages that ate and left no crumbs. it's all about Distinguished name display options — yeah, the thing that controls how your DNs look when OpenSSL prints them. come sit with me 🫶

✨ NAME ✨

openssl-namedisplay-options — Distinguished name display options 💅

like. it's the vibe controller for how subject and issuer DNs show up on your screen. that's the whole job.

✨ SYNOPSIS ✨

openssl command [ options ... ] [ parameters ... ]

yep that's literally it, no cap 🙈 the real goodies live down in -nameopt.

✨ DESCRIPTION ✨

okay so here's the tea ☕ OpenSSL gives you fine-grain control over how the subject and issuer DN's are displayed. you do this with the -nameopt option, which takes a comma-separated list of options from the set below. (the set is coming, be patient, it's iconic.)

any option can be preceded by a minus sign, "-", to turn it off. switch it off, bestie, it's your world. and here's the helpful bit: the first four option arguments are the most commonly used — so those are the ones you'll actually be reaching for most days 🎀

the default value is:

"esc_ctrl,utf8,dump_unknown,dump_der,sep_comma_plus_space,sname"

memorise her or don't, but know she's the baseline vibe.

✨ OPTIONS ✨

🌸 Name Format Option Arguments 🌸

the DN output format can be fine tuned with the following flags. let's go one by one, no skipping, we're thorough in this house 💜

  • compat — display the name using an old format from previous OpenSSL versions. it's giving nostalgia, it's giving legacy 🧚
  • RFC2253 — display the name using the format defined in RFC 2253. it is equivalent to esc_2253, esc_ctrl, esc_msb, utf8, dump_nostr, dump_unknown, dump_der, sep_comma_plus, dn_rev and sname. yeah that's a lot of little options doing a group project and honestly? they ate 🌟
  • oneline — display the name in one line, using a format that is more readable RFC 2253. it is equivalent to the esc_2253, esc_ctrl, esc_msb, utf8, dump_nostr, dump_der, use_quote, sep_comma_plus_space, space_eq and sname options. one line, still classy, still understood 😌
  • multiline — display the name using multiple lines. it is equivalent to esc_ctrl, esc_msb, sep_multiline, space_eq, lname and align. she's tall, she's structured, she's a whole staircase of info 📚
  • esc_2253 — escape the "special" characters in a field, as required by RFC 2253. that's any of the characters ",+"<>;", "#" at the beginning of a string, and leading or trailing spaces. leaving them unescaped is not the move 🚫
  • esc_2254 — escape the "special" characters in a field as required by RFC 2254 in a field. that's the NUL character and the characters "()*".
  • esc_ctrl — escape non-printable ASCII characters, codes less than 0x20 (space) or greater than 0x7F (DELETE). they get displayed using RFC 2253 "\XX" notation where XX are the two hex digits representing the character value. cute little secret code, honestly 🔥
  • esc_msb — escape any characters with the most significant bit set, that is with values larger than 127, as described in esc_ctrl. same energy, higher bits 💫
  • use_quote — escapes some characters by surrounding the entire string with quotation marks, """. without this option, individual special characters are preceded with a backslash character, "\". pick your fighter, both are valid 😤
  • utf8 — convert all strings to UTF-8 format first as required by RFC 2253. if the output device is UTF-8 compatible, then using this option (and not setting esc_msb) may give the correct display of multibyte characters ✨ and listen, if this option is not set, then multibyte characters larger than 0xFF will be output as "\UXXXX" for 16 bits or "\WXXXXXXXX" for 32 bits. also, any UTF8Strings will be converted to their character form first. she does the conversion work and the formatting, main character behaviour fr 👑
  • ignore_type — this option does not attempt to interpret multibyte characters in any way. that is, the content octets are merely dumped as though one octet represents each character. this is useful for diagnostic purposes but will result in rather odd looking output 🙈 like it works, it's just not gonna be pretty. diagnostic girlies, this one's for you.
  • show_type — display the type of the ASN1 character string before the value, such as "BMPSTRING: Hello World". so you actually know what you're looking at 💅
  • dump_der — any fields that would be output in hex format are displayed using the DER encoding of the field. if not set, just the content octets are displayed. either way, the #XXXX... format of RFC 2253 is used. consistent format, different contents, love that 🎀
  • dump_nostr — dump non-character strings, such as ASN.1 OCTET STRING. if this option is not set, then non character string types will be displayed as though each content octet represents a single character. ngl this one's a lifesaver when things get weird 🔥
  • dump_all — dump all fields. when this is used with dump_der, this allows the DER encoding of the structure to be unambiguously determined. "unambiguously" is doing so much heavy lifting here and honestly she deserves it 💜
  • dump_unknown — dump any field whose OID is not recognised by OpenSSL. mystery OID? we still show her. no gatekeeping 🫶
  • sep_comma_plus, sep_comma_plus_space, sep_semi_plus_space, sep_multiline — specify the field separators. the first word is used between the Relative Distinguished Names (RDNs) and the second is between multiple Attribute Value Assertions (AVAs). multiple AVAs are very rare and their use is discouraged 🚫 (like, we don't do that here). the options ending in "space" additionally place a space after the separator to make it more readable. the sep_multiline starts each field on its own line, and uses "plus space" for the AVA separator. it also indents the fields by four characters. the default value is sep_comma_plus_space. okay that was a lot but you got it 💖
  • dn_rev — reverse the fields of the DN as required by RFC 2253. this also reverses the order of multiple AVAs in a field, but this is permissible as there is no ordering on values. flip it, it's fine, nobody's mad 😌
  • nofname, sname, lname, oid — specify how the field name is displayed. nofname does not display the field at all (she's mysterious, she's anonymous 💀). sname uses the "short name" form (CN for commonName for example). lname uses the long form. oid represents the OID in numerical form and is useful for diagnostic purpose.
  • align — align field values for a more readable output. only usable with sep_multiline. you can't just use it wherever, she has ONE job and she needs the right conditions 🌈
  • space_eq — places spaces round the equal sign, "=", character which follows the field name. breathing room for the equals sign, as she deserves ✨
Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>. (yes bestie, actually read the license, it's the law and it's also just polite 💜)

aaaand that's the whole page, we did it 🎉 this was OpenSSL 4.0.3, dated 2026-09-29, from the OpenSSL manual pages — that's the version and the date, so you always know what era of the docs you're reading 💖 slay, go beautify some DNs, mwah 💅🎀🦋

📦 where this page comes from