StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p><code>openssl x509</code> does not read the extensions configuration you've specified above in your config file.</p> <p>You can get the <code>crlDistributionPoints</code> into your certificate in (at least) these two ways:</p> <ol> <li><p>Use <code>openssl ca</code> rather than <code>x509</code> to sign the request. Pass <code>-config</code> as needed if your config is not in a default location. Most of your provided command can be used if you omit the options starting with <code>-CA</code></p> <p><code>openssl ca -in $NAME.csr -out certs/$NAME.pem -days 3650</code></p></li> <li><p>Use the command as you've provided in your question, but first create a file containing your v3 extensions (ie <code>mycrl.cnf</code>); add the option <code>-extfile mycrl.cnf</code> to your call to <code>openssl x509</code></p> <pre><code>openssl x509 -req -in $NAME.csr -out certs/$NAME.pem -days 3650 \ -CAcreateserial -CA cacert.pem -CAkey private/cakey.pem \ -CAserial serial -extfile mycrl.cnf` </code></pre> <p>Where <code>mycrl.cnf</code> contains the following:</p> <p><code>crlDistributionPoints=URI:http://example.com/crl.pem</code></p></li> </ol> <p><code>openssl ca</code> is probably the command better suited to what you want to do, since most examples you will find rely on that command utilizing various settings in openssl.cnf for v3 extensions.</p> <p>An aside: it is <a href="http://www.kb.cert.org/vuls/id/836068/" rel="noreferrer">inadvisable</a> to use MD5 message digest in certificates.</p> <p>Previously SHA1 was the suggested alternative to MD5, however that too is now becoming deprecated. You can specify the message digest used in requests and signing operations, and you can list the supported message digests with <code>openssl list-message-digest-commands</code>.</p> <p>As an example, you can use SHA256 when signing a request with the <code>-md sha256</code> option to <code>openssl ca</code> ( or setting <code>default_md=sha256</code> in your <code>[CA_default]</code> config section).</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload