| blob | 19608697e36b025bea76d61d50ad1ca27b765950 |
1 .\" $OpenBSD: x509v3.cnf.5,v 1.3 2016/12/25 22:15:10 schwarze Exp $
2 .\" OpenSSL 99d63d46 Oct 26 13:56:48 2016 -0400
3 .\"
4 .\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5 .\" Copyright (c) 2004, 2006, 2013, 2014, 2015, 2016 The OpenSSL Project.
6 .\" All rights reserved.
7 .\"
8 .\" Redistribution and use in source and binary forms, with or without
9 .\" modification, are permitted provided that the following conditions
10 .\" are met:
11 .\"
12 .\" 1. Redistributions of source code must retain the above copyright
13 .\" notice, this list of conditions and the following disclaimer.
14 .\"
15 .\" 2. Redistributions in binary form must reproduce the above copyright
16 .\" notice, this list of conditions and the following disclaimer in
17 .\" the documentation and/or other materials provided with the
18 .\" distribution.
19 .\"
20 .\" 3. All advertising materials mentioning features or use of this
21 .\" software must display the following acknowledgment:
22 .\" "This product includes software developed by the OpenSSL Project
23 .\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
24 .\"
25 .\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 .\" endorse or promote products derived from this software without
27 .\" prior written permission. For written permission, please contact
28 .\" openssl-core@openssl.org.
29 .\"
30 .\" 5. Products derived from this software may not be called "OpenSSL"
31 .\" nor may "OpenSSL" appear in their names without prior written
32 .\" permission of the OpenSSL Project.
33 .\"
34 .\" 6. Redistributions of any form whatsoever must retain the following
35 .\" acknowledgment:
36 .\" "This product includes software developed by the OpenSSL Project
37 .\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
38 .\"
39 .\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 .\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 .\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 .\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 .\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 .\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 .\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
51 .\"
52 .Dd $Mdocdate: December 25 2016 $
53 .Dt X509V3.CNF 5
54 .Os
55 .Sh NAME
56 .Nm x509v3.cnf
57 .Nd X.509 V3 certificate extension configuration format
58 .Sh DESCRIPTION
59 Several of the OpenSSL utilities can add extensions to a certificate or
60 certificate request based on the contents of a configuration file.
61 The file format is based on the
62 .Xr openssl.cnf 5
63 format.
64 .Pp
65 Typically the application will contain an option to point to an
66 extension section.
67 Each line of the extension section takes the form:
68 .Pp
69 .D1 Ar extension_name Ns = Ns Oo Cm critical , Oc Ar extension_options
70 .Pp
71 If
72 .Cm critical
73 is present, then the extension will be critical.
74 .Pp
75 The format of
76 .Ar extension_options
77 depends on the value of
78 .Ar extension_name .
79 .Pp
80 There are four main types of extension: string extensions, multi-valued
81 extensions, raw extensions, and arbitrary extensions.
82 .Pp
83 String extensions simply have a string which contains either the value
84 itself or how it is obtained.
85 For example:
86 .Pp
87 .Dl nsComment="This is a Comment"
88 .Pp
89 Multi-valued extensions have a short form and a long form.
90 The short form is a list of names and values:
91 .Pp
92 .Dl basicConstraints=critical,CA:true,pathlen:1
93 .Pp
94 The long form allows the values to be placed in a separate section:
95 .Bd -literal -offset indent
96 basicConstraints=critical,@bs_section
98 [bs_section]
99 CA=true
100 pathlen=1
101 .Ed
102 .Pp
103 Both forms are equivalent.
104 .Pp
105 The syntax of raw extensions is governed by the extension code:
106 it can for example contain data in multiple sections.
107 The correct syntax to use is defined by the extension code itself:
108 check out the certificate policies extension for an example.
109 .Pp
110 If an extension type is unsupported, then the arbitrary extension
111 syntax must be used; see the
112 .Sx ARBITRARY EXTENSIONS
113 section for more details.
114 .Sh STANDARD EXTENSIONS
115 The following sections describe each supported extension in detail.
116 .Ss Basic constraints
117 This is a multi-valued extension which indicates whether a certificate
118 is a CA certificate.
119 The first (mandatory) name is
120 .Ic CA
121 followed by
122 .Cm TRUE
123 or
124 .Cm FALSE .
125 If
126 .Ic CA
127 is
128 .Cm TRUE ,
129 then an optional
130 .Ic pathlen
131 name followed by an non-negative value can be included.
132 For example:
133 .Bd -literal -offset indent
134 basicConstraints=CA:TRUE
135 basicConstraints=CA:FALSE
136 basicConstraints=critical,CA:TRUE, pathlen:0
137 .Ed
138 .Pp
139 A CA certificate must include the
140 .Ic basicConstraints
141 value with the
142 .Ic CA
143 field set to
144 .Cm TRUE .
145 An end user certificate must either set
146 .Ic CA
147 to
148 .Cm FALSE
149 or exclude the extension entirely.
150 Some software may require the inclusion of
151 .Ic basicConstraints
152 with
153 .Ic CA
154 set to
155 .Cm FALSE
156 for end entity certificates.
157 .Pp
158 The
159 .Ic pathlen
160 parameter indicates the maximum number of CAs that can appear below
161 this one in a chain.
162 So if you have a CA with a
163 .Ic pathlen
164 of zero it can only be used to sign end user certificates and not
165 further CAs.
166 .Ss Key usage
167 Key usage is a multi-valued extension consisting of a list of names of
168 the permitted key usages.
169 .Pp
170 The supported names are:
171 .Ic digitalSignature ,
172 .Ic nonRepudiation ,
173 .Ic keyEncipherment ,
174 .Ic dataEncipherment ,
175 .Ic keyAgreement ,
176 .Ic keyCertSign ,
177 .Ic cRLSign ,
178 .Ic encipherOnly ,
179 and
180 .Ic decipherOnly .
181 Examples:
182 .Bd -literal -offset indent
183 keyUsage=digitalSignature, nonRepudiation
184 keyUsage=critical, keyCertSign
185 .Ed
186 .Ss Extended key usage
187 This extensions consists of a list of usages indicating purposes for
188 which the certificate public key can be used for.
189 .Pp
190 These can either be object short names or the dotted numerical form of OIDs.
191 While any OID can be used, only certain values make sense.
192 In particular the following PKIX, NS and MS values are meaningful:
193 .Bl -column emailProtection
194 .It Em value Ta Em meaning
195 .It Ic serverAuth Ta SSL/TLS web server authentication
196 .It Ic clientAuth Ta SSL/TLS web client authentication
197 .It Ic codeSigning Ta code signing
198 .It Ic emailProtection Ta E-mail protection (S/MIME)
199 .It Ic timeStamping Ta trusted timestamping
200 .It Ic OCSPSigning Ta OCSP signing
201 .It Ic ipsecIKE Ta IPsec internet key exchange
202 .It Ic msCodeInd Ta Microsoft individual code signing (authenticode)
203 .It Ic msCodeCom Ta Microsoft commercial code signing (authenticode)
204 .It Ic msCTLSign Ta Microsoft trust list signing
205 .It Ic msEFS Ta Microsoft encrypted file system
206 .El
207 .Pp
208 Examples:
209 .Bd -literal -offset indent
210 extendedKeyUsage=critical,codeSigning,1.2.3.4
211 extendedKeyUsage=serverAuth,clientAuth
212 .Ed
213 .Ss Subject key identifier
214 This is really a string extension and can take two possible values.
215 Either the word
216 .Cm hash
217 which will automatically follow the guidelines in RFC 3280
218 or a hex string giving the extension value to include.
219 The use of the hex string is strongly discouraged.
220 Example:
221 .Pp
222 .Dl subjectKeyIdentifier=hash
223 .Ss Authority key identifier
224 The authority key identifier extension permits two options,
225 .Cm keyid
226 and
227 .Cm issuer :
228 both can take the optional value
229 .Cm always .
230 .Pp
231 If the
232 .Cm keyid
233 option is present, an attempt is made to copy the subject
234 key identifier from the parent certificate.
235 If the value
236 .Cm always
237 is present, then an error is returned if the option fails.
238 .Pp
239 The
240 .Cm issuer
241 option copies the issuer and serial number from the issuer certificate.
242 This will only be done if the
243 .Cm keyid
244 option fails or is not included unless the
245 .Cm always
246 flag will always include the value.
247 Example:
248 .Pp
249 .Dl authorityKeyIdentifier=keyid,issuer
250 .Ss Subject alternative name
251 The subject alternative name extension allows various literal values to
252 be included in the configuration file.
253 These include
254 .Ic email
255 (an email address),
256 .Ic URI
257 (a uniform resource indicator),
258 .Ic DNS
259 (a DNS domain name),
260 .Ic RID
261 (a registered ID: OBJECT IDENTIFIER),
262 .Ic IP
263 (an IP address),
264 .Ic dirName
265 (a distinguished name), and
266 .Ic otherName .
267 .Pp
268 The
269 .Ic email
270 option can include a special
271 .Cm copy
272 value.
273 This will automatically include any email addresses contained in the
274 certificate subject name in the extension.
275 .Pp
276 The IP address used in the
277 .Ic IP
278 options can be in either IPv4 or IPv6 format.
279 .Pp
280 The value of
281 .Ic dirName
282 should point to a section containing the distinguished name to use as a
283 set of name value pairs.
284 Multi values AVAs can be formed by prefacing the name with a
285 .Ql +
286 character.
287 .Pp
288 .Ic otherName
289 can include arbitrary data associated with an OID: the value should
290 be the OID followed by a semicolon and the content in standard
291 .Xr ASN1_generate_nconf 3
292 format.
293 Examples:
294 .Bd -literal -offset 2n
295 subjectAltName=email:copy,email:my@other.address,URI:http://my.url.here/
296 subjectAltName=IP:192.168.7.1
297 subjectAltName=IP:13::17
298 subjectAltName=email:my@other.address,RID:1.2.3.4
299 subjectAltName=otherName:1.2.3.4;UTF8:some other identifier
301 subjectAltName=dirName:dir_sect
303 [dir_sect]
304 C=UK
305 O=My Organization
306 OU=My Unit
307 CN=My Name
308 .Ed
309 .Ss Issuer alternative name
310 The issuer alternative name option supports all the literal options of
311 subject alternative name.
312 It does not support the
313 .Ic email : Ns Cm copy
314 option because that would not make sense.
315 It does support an additional
316 .Ic issuer : Ns Cm copy
317 option that will copy all the subject alternative name values from
318 the issuer certificate (if possible).
319 Example:
320 .Pp
321 .Dl issuserAltName = issuer:copy
322 .Ss Authority info access
323 The authority information access extension gives details about how to
324 access certain information relating to the CA.
325 Its syntax is
326 .Ar accessOID ; location
327 where
328 .Ar location
329 has the same syntax as subject alternative name (except that
330 .Ic email : Ns Cm copy
331 is not supported).
332 .Ar accessOID
333 can be any valid OID but only certain values are meaningful,
334 for example
335 .Cm OCSP
336 and
337 .Cm caIssuers .
338 Example:
339 .Bd -literal -offset indent
340 authorityInfoAccess = OCSP;URI:http://ocsp.my.host/
341 authorityInfoAccess = caIssuers;URI:http://my.ca/ca.html
342 .Ed
343 .Ss CRL distribution points
344 This is a multi-valued extension whose options can be either in
345 .Ar name : Ns Ar value
346 pair form using the same form as subject alternative name or a
347 single value representing a section name containing all the
348 distribution point fields.
349 .Pp
350 For a
351 .Ar name : Ns Ar value
352 pair a new DistributionPoint with the fullName field set to the
353 given value, both the cRLissuer and reasons fields are omitted in
354 this case.
355 .Pp
356 In the single option case, the section indicated contains values
357 for each field.
358 In this section:
359 .Pp
360 If the name is
361 .Ic fullname ,
362 the value field should contain the full name of the distribution
363 point in the same format as subject alternative name.
364 .Pp
365 If the name is
366 .Ic relativename ,
367 then the value field should contain a section name whose contents
368 represent a DN fragment to be placed in this field.
369 .Pp
370 The name
371 .Ic CRLIssuer ,
372 if present, should contain a value for this field in subject
373 alternative name format.
374 .Pp
375 If the name is
376 .Ic reasons ,
377 the value field should consist of a comma separated field containing
378 the reasons.
379 Valid reasons are:
380 .Cm keyCompromise ,
381 .Cm CACompromise ,
382 .Cm affiliationChanged ,
383 .Cm superseded ,
384 .Cm cessationOfOperation ,
385 .Cm certificateHold ,
386 .Cm privilegeWithdrawn ,
387 and
388 .Cm AACompromise .
389 .Pp
390 Simple examples:
391 .Bd -literal -offset indent
392 crlDistributionPoints=URI:http://myhost.com/myca.crl
393 crlDistributionPoints=URI:http://my.com/my.crl,URI:http://oth.com/my.crl
394 .Ed
395 .Pp
396 Full distribution point example:
397 .Bd -literal -offset indent
398 crlDistributionPoints=crldp1_section
400 [crldp1_section]
401 fullname=URI:http://myhost.com/myca.crl
402 CRLissuer=dirName:issuer_sect
403 reasons=keyCompromise, CACompromise
405 [issuer_sect]
406 C=UK
407 O=Organisation
408 CN=Some Name
409 .Ed
410 .Ss Issuing distribution point
411 This extension should only appear in CRLs.
412 It is a multi-valued extension whose syntax is similar to the "section"
413 pointed to by the CRL distribution points extension with a few
414 differences.
415 .Pp
416 The names
417 .Ic reasons
418 and
419 .Ic CRLissuer
420 are not recognized.
421 .Pp
422 The name
423 .Ic onlysomereasons
424 is accepted, which sets this field.
425 The value is in the same format as the CRL distribution point
426 .Ic reasons
427 field.
428 .Pp
429 The names
430 .Ic onlyuser ,
431 .Ic onlyCA ,
432 .Ic onlyAA ,
433 and
434 .Ic indirectCRL
435 are also accepted.
436 The values should be a boolean values
437 .Cm ( TRUE
438 or
439 .Cm FALSE )
440 to indicate the value of the corresponding field.
441 Example:
442 .Bd -literal -offset indent
443 issuingDistributionPoint=critical, @idp_section
445 [idp_section]
446 fullname=URI:http://myhost.com/myca.crl
447 indirectCRL=TRUE
448 onlysomereasons=keyCompromise, CACompromise
450 [issuer_sect]
451 C=UK
452 O=Organisation
453 CN=Some Name
454 .Ed
455 .Ss Certificate policies
456 This is a raw extension.
457 All the fields of this extension can be set by using the appropriate
458 syntax.
459 .Pp
460 If you follow the PKIX recommendations and just use one OID, then you
461 just include the value of that OID.
462 Multiple OIDs can be set separated by commas, for example:
463 .Pp
464 .Dl certificatePolicies= 1.2.4.5, 1.1.3.4
465 .Pp
466 If you wish to include qualifiers, then the policy OID and qualifiers
467 need to be specified in a separate section: this is done by using the
468 .Pf @ Ar section
469 syntax instead of a literal OID value.
470 .Pp
471 The section referred to must include the policy OID using the name
472 .Ic policyIdentifier .
473 .Ic CPSuri
474 qualifiers can be included using the syntax:
475 .Pp
476 .D1 Ic CPS . Ns Ar nnn Ns = Ns Ar value
477 .Pp
478 .Ic userNotice
479 qualifiers can be set using the syntax:
480 .Pp
481 .D1 Ic userNotice . Ns Ar nnn Ns =@ Ns Ar notice
482 .Pp
483 The value of the
484 .Ic userNotice
485 qualifier is specified in the relevant section.
486 This section can include
487 .Ic explicitText ,
488 .Ic organization ,
489 and
490 .Ic noticeNumbers
491 options.
492 .Ic explicitText
493 and
494 .Ic organization
495 are text strings,
496 and
497 .Ic noticeNumbers
498 is a comma separated list of numbers.
499 The
500 .Ic organization
501 and
502 .Ic noticeNumbers
503 options (if included) must
504 .Em both
505 be present.
506 If you use the
507 .Ic userNotice
508 option with IE5 then you need the
509 .Ic ia5org
510 option at the top level to modify the encoding: otherwise it will
511 not be interpreted properly.
512 Example:
513 .Bd -literal -offset indent
514 certificatePolicies=ia5org,1.2.3.4,1.5.6.7.8,@polsect
516 [polsect]
517 policyIdentifier = 1.3.5.8
518 CPS.1="http://my.host.name/"
519 CPS.2="http://my.your.name/"
520 userNotice.1=@notice
522 [notice]
523 explicitText="Explicit Text Here"
524 organization="Organisation Name"
525 noticeNumbers=1,2,3,4
526 .Ed
527 .Pp
528 The
529 .Ic ia5org
530 option changes the type of the
531 .Ic organization
532 field.
533 In RFC 2459, it can only be of type
534 .Vt DisplayText .
535 In RFC 3280,
536 .Vt IA5String
537 is also permissible.
538 Some software (for example some versions of MSIE) may require
539 .Ic ia5org .
540 .Ss Policy constraints
541 This is a multi-valued extension which consists of the names
542 .Ic requireExplicitPolicy
543 or
544 .Ic inhibitPolicyMapping
545 and a non-negative integer value.
546 At least one component must be present.
547 Example:
548 .Pp
549 .Dl policyConstraints = requireExplicitPolicy:3
550 .Ss Inhibit any policy
551 This is a string extension whose value must be a non-negative integer.
552 Example:
553 .Pp
554 .Dl inhibitAnyPolicy = 2
555 .Ss Name constraints
556 The name constraints extension is a multi-valued extension.
557 The name should begin with the word
558 .Cm permitted
559 or
560 .Cm excluded ,
561 followed by a semicolon.
562 The rest of the name and the value follows the syntax of subjectAltName
563 except
564 .Ic email : Ns Cm copy
565 is not supported and the
566 .Ic IP
567 form should consist of an IP addresses and subnet mask separated
568 by a slash.
569 Examples:
570 .Bd -literal -offset indent
571 nameConstraints=permitted;IP:192.168.0.0/255.255.0.0
572 nameConstraints=permitted;email:.somedomain.com
573 nameConstraints=excluded;email:.com
574 .Ed
575 .Ss OCSP no check
576 The OCSP no check extension is a string extension,
577 but its value is ignored.
578 Example:
579 .Pp
580 .Dl noCheck = ignored
581 .Ss TLS Feature (aka must staple)
582 This is a multi-valued extension consisting of a list of TLS extension
583 identifiers.
584 Each identifier may be a number in the range from 0 to 65535 or a
585 supported name.
586 When a TLS client sends a listed extension, the TLS server is expected
587 to include that extension in its reply.
588 .Pp
589 The supported names are:
590 .Cm status_request
591 and
592 .Cm status_request_v2 .
593 Example:
594 .Pp
595 .Dl tlsfeature = status_request
596 .Sh DEPRECATED EXTENSIONS
597 The following extensions are non-standard, Netscape specific and largely
598 obsolete.
599 Their use in new applications is discouraged.
600 .Ss Netscape string extensions
601 Netscape comment
602 .Ic ( nsComment )
603 is a string extension containing a comment which will be displayed when
604 the certificate is viewed in some browsers.
605 Example:
606 .Pp
607 .Dl nsComment = "Some Random Comment"
608 .Pp
609 Other supported extensions in this category are:
610 .Ic nsBaseUrl ,
611 .Ic nsRevocationUrl ,
612 .Ic nsCaRevocationUrl ,
613 .Ic nsRenewalUrl ,
614 .Ic nsCaPolicyUrl ,
615 and
616 .Ic nsSslServerName .
617 .Ss Netscape certificate type
618 This is a multi-valued extensions which consists of a list of flags to
619 be included.
620 It was used to indicate the purposes for which a certificate could be
621 used.
622 The
623 .Ic basicConstraints ,
624 .Ic keyUsage ,
625 and extended key usage extensions are now used instead.
626 .Pp
627 Acceptable values for
628 .Ic nsCertType
629 are:
630 .Cm client ,
631 .Cm server ,
632 .Cm email ,
633 .Cm objsign ,
634 .Cm reserved ,
635 .Cm sslCA ,
636 .Cm emailCA ,
637 .Cm objCA .
638 .Sh ARBITRARY EXTENSIONS
639 If an extension is not supported by the OpenSSL code, then it must
640 be encoded using the arbitrary extension format.
641 It is also possible to use the arbitrary format for supported
642 extensions.
643 Extreme care should be taken to ensure that the data is formatted
644 correctly for the given extension type.
645 .Pp
646 There are two ways to encode arbitrary extensions.
647 .Pp
648 The first way is to use the word
649 .Cm ASN1
650 followed by the extension content using the same syntax as
651 .Xr ASN1_generate_nconf 3 .
652 For example:
653 .Bd -literal -offset indent
654 1.2.3.4=critical,ASN1:UTF8String:Some random data
655 1.2.3.4=ASN1:SEQUENCE:seq_sect
657 [seq_sect]
658 field1 = UTF8:field1
659 field2 = UTF8:field2
660 .Ed
661 .Pp
662 It is also possible to use the word
663 .Cm DER
664 to include the raw encoded data in any extension.
665 .Bd -literal -offset indent
666 1.2.3.4=critical,DER:01:02:03:04
667 1.2.3.4=DER:01020304
668 .Ed
669 .Pp
670 The value following
671 .Cm DER
672 is a hex dump of the DER encoding of the extension.
673 Any extension can be placed in this form to override the default behaviour.
674 For example:
675 .Pp
676 .Dl basicConstraints=critical,DER:00:01:02:03
677 .Sh FILES
678 .Bl -tag -width /etc/ssl/x509v3.cnf -compact
679 .It Pa /etc/ssl/x509v3.cnf
680 standard configuration file
681 .El
682 .Sh SEE ALSO
683 .Xr openssl 1 ,
684 .Xr ASN1_generate_nconf 3 ,
685 .Xr openssl.cnf 5
686 .Sh HISTORY
687 X509v3 extension code was first added to OpenSSL 0.9.2.
688 .Sh CAVEATS
689 There is no guarantee that a specific implementation will process a
690 given extension.
691 It may therefore sometimes be possible to use certificates for purposes
692 prohibited by their extensions because a specific application does not
693 recognize or honour the values of the relevant extensions.
694 .Pp
695 The
696 .Cm DER
697 and
698 .Cm ASN1
699 options should be used with caution.
700 It is possible to create totally invalid extensions if they are not used
701 carefully.
702 .Pp
703 If an extension is multi-value and a field value must contain a comma,
704 the long form must be used.
705 Otherwise the comma would be misinterpreted as a field separator.
706 For example,
707 .Pp
708 .Dl subjectAltName=URI:ldap://somehost.com/CN=foo,OU=bar
709 .Pp
710 will produce an error, but the following form is valid:
711 .Bd -literal -offset indent
712 subjectAltName=@subject_alt_section
714 [subject_alt_section]
715 subjectAltName=URI:ldap://somehost.com/CN=foo,OU=bar
716 .Ed
717 .Pp
718 Due to the behaviour of the OpenSSL CONF library, the same field
719 name can only occur once in a section.
720 That means that
721 .Bd -literal -offset indent
722 subjectAltName=@alt_section
724 [alt_section]
725 email=steve@here
726 email=steve@there
727 .Ed
728 .Pp
729 will only use the last value.
730 This can be worked around by using the form:
731 .Bd -literal -offset indent
732 [alt_section]
733 email.1=steve@here
734 email.2=steve@there
735 .Ed