There's no way to replace an OpenSSL::X509::Name entry.

[evilsocket]

Given a OpenSSL::X509::Name object, there's only an add_entry method to manipulate its entries, but this method will always append due to the -1 argument specified here.

If the object already contains an entry with the specified name, the method should instead find its index and replace it, otherwise the new appended entry won't be visible from browsers for instance, as they only get the first entry with a given name.

Ideally, a new set_entry or replace_entry method would be needed.

Ref. to the issue where this behaviour was highlighted this.

[rhenium]

I'm afraid a method like #replace_entry wouldn't be useful, because a distinguished name can contain multiple attributes with the same type. E.g.

dn = OpenSSL::X509::Certificate.new(File.read("/etc/ssl/certs/VeriSign_Class_3_Public_Primary_Certification_Authority_-_G5.pem")).subject
pp dn.to_a #=>
[["C", "US", 19],
 ["O", "VeriSign, Inc.", 19],
 ["OU", "VeriSign Trust Network", 19],
 ["OU", "(c) 2006 VeriSign, Inc. - For authorized use only", 19],
 ["CN", "VeriSign Class 3 Public Primary Certification Authority - G5", 19]]

dn.replace_entry("OU", "Test Unit") # which existing OU attribute will be replaced?

If you don't care about multi-valued RDN, you can convert into an array by OpenSSL::X509::Name#to_a and modify it, and re-construct by passing the modified array to OpenSSL::X509::Name.new.

[evilsocket]

what about an optional "index" parameter (default to -1 as in the current implementation) for the add_entry method?

[rhenium]

The ability to specify the position to insert would be a good addition for completeness. I'll do this for the next version.