OpenSSL always shows "unsupported" for all subjectAltName "otherName" UTF8 values

Solution 1:

FYI, you will have to locate the "OCTET STRING" line just below the "OBJECT :X509v3 Subject Alternative Name" line then strparse:

# print section offset via
openssl asn1parse -in yourcert.pem
# parse otherName from "OCTET STRING" 
openssl asn1parse -in yourcert.pem -strparse <offset>

Solution 2:

Probably still unsupported. Try asn1parse.

The <unsupported> output was the regular result in 2010. My guess: this is still the case.

An OpenSSL dev said this on the mailing list (Archived here.):

Steven Hensen, 2010-01-02:

Currently OpenSSL doesn't display any otherName values. It can't know the precise meaning of that field in general because the format could be totally arbitrary. At best it could asn1parse the contents.

And if you use openssl asn1parse on the file to find the offset of the :X509v3 Subject Alternative Name section and then use the -strparse option with that offset, then otherName will in fact be displayed.