subjectAltName</b> or <b>issuerAltName</b> extensions.</p>

</li>
<li><p>They must have the <b>proxyCertInfo</b> extension.</p>

</li>
<li><p>They must have the subject of their issuer, with one <b>commonName</b> added.</p>

</li>
</ul>

<h2 id="Enabling-proxy-certificate-verification">Enabling proxy certificate verification</h2>

<p>OpenSSL expects applications that want to use proxy certificates to be specially aware of them, and make that explicit. This is done by setting an X509 verification flag:</p>

