+proc hack-openssl-dn {out} {
+ ## Convert OpenSSL's hopeless output into a DN.
+
+ if {[regexp {^subject=\s*(/.*)$} $out -> dn]} { return $dn }
+ if {[regexp {^subject=(.*)$} $out -> t]} {
+ set t [regsub {^(\w+) = } $t {/\1=}]
+ set t [regsub -all {, (\w+) = } $t {/\1=}]
+ return $t
+ }
+}
+