How to use "otherName" for subject alternative name in end entity profile

[Mik4sa]

I would like to use "otherName" in my subject alternativ names for my end entity profile but the dropdown list seems to not include this:

Though I would espect it to be there because it's located in here:

ejbca-ce/src/java/profilemappings.properties

Line 71 in 39b6c93

ALTNAME;OTHERNAME;16;OTHERNAME;20;Other name;ALT_PKIX_OTHERNAME

Can somebody explain or help me?

[primetomas]

otherName is a trash bucket for custom ASN.1 encoded things. Many of the things in the drop down are in fact "otherName"s, such as Kerberos principsp, permanent identifier, XmppAddr, Service name, SIM. There is no such thing as a generic "otherName" because there must be specific ASN.1 defined for these. So what "otherName" you want to use, should be specified in an RFC, with accompanying ASN.1 definition.

[Mik4sa]

Well ok. Maybe I bring up my actual problem. I wanted to use the MS UPN field and enter a simple username like "mikasa" but I wasn't able to do so. It looked like I was forced to enter a (valid) mail adress. Is that true?

[primetomas]

UPN is supposed to be username@domain.
https://learn.microsoft.com/en-us/windows/win32/secauthn/user-name-formats

[ralienpp]

@primetomas, how can one configure EJBCA to let an arbitrary otherName structure go through?

Suppose that:

• I have a proprietary construction which is not featured in the dropdown list in Mik4sa's screenshot
• I have a registration authority in front of EBCA, which ensures that this structure conforms to my own ASN.1 definition

How can I ensure that the issued certificates will include my custom subjectAltName "as is"?

[primetomas]

Use either “allow extension override” or a dynamic “custom extension” for the subject altName extension.