Mimi, On Wed, Jul 14, 2021 at 12:16:57PM -0400, Mimi Zohar wrote: > On Mon, 2021-07-12 at 08:44 +0300, Vitaly Chikunov wrote: > > > > @@ -43,26 +43,43 @@ cat > test-ca.conf <<- EOF > > basicConstraints=CA:TRUE > > subjectKeyIdentifier=hash > > authorityKeyIdentifier=keyid:always,issuer > > + > > + [ skid ] > > + basicConstraints=CA:TRUE > > + subjectKeyIdentifier=12345678 > > + authorityKeyIdentifier=keyid:always,issuer > > EOF > > fi > > On my system: > $ openssl version > OpenSSL 1.1.1g FIPS 21 Apr 2020 > > Not sure this has anything to do with the reason that "skid" is not > supported. The resulting files are empty. > > ls -lat *skid* > -rw-rw-r--. 1 mimi mimi 0 Jul 14 12:02 test-rsa1024_skid.key > -rw-rw-r--. 1 mimi mimi 0 Jul 14 12:02 test-rsa1024_skid.pub > > - openssl pkey -in test-rsa1024.key -out test-rsa1024.pub -pubout > - openssl req -verbose -new -nodes -utf8 -sha1 -days 10000 -batch -x509 > -extensions skid -config test-ca.conf -newkey rsa:1024 -out test- > rsa1024_skid.cer -outform DER -keyout test-rsa1024_skid.key > Using configuration from test-ca.conf > Error Loading extension section skid <=== Is it reproducible? Since multiple-distributions CI passed, I wonder what distro it is. Thanks,
