286507 - certutil needs non-interactive way to specify cert extensions

Status: NEW

(NSS :: Tools, enhancement, P3)

Description

[Nelson Bolyard (seldom reads bugmail)]

When certutil is run to create a cert or CSR, and command line options
are given to request certain cert extensions, certutil goes into a
line-by-line prompt-and-answer interactive mode to collect info about
the extensions.  This is not good for scripting.

certutil needs a non-interactive way to be able to fully specify all the 
extensions that it now can create.  

Here is a suggestion for how it might be done (not required to be this way):
I suggest a single new command line options that takes a string argument.
The command line option says "add an extension specified as follows".
The string will specify all the following:
  - the extension type/name
  - izzit critical
  - any other relevant options, e.g. is-a-ca, path length constrraint, 
    key usage, etc.

I'd prefer if the argument string used mnemonic names rather than numbers
where possible, e.g. "KE" or "Key cipher" or "Key Encipherment" rather than 2.

This is all in addition to the existing methods, not a replacement for them.