On Wed, 2021-07-14 at 21:13 +0300, Vitaly Chikunov wrote: > Mimi, > > On Wed, Jul 14, 2021 at 12:16:57PM -0400, Mimi Zohar wrote: > > On Mon, 2021-07-12 at 08:44 +0300, Vitaly Chikunov wrote: > > > > > > @@ -43,26 +43,43 @@ cat > test-ca.conf <<- EOF > > > basicConstraints=CA:TRUE > > > subjectKeyIdentifier=hash > > > authorityKeyIdentifier=keyid:always,issuer > > > + > > > + [ skid ] > > > + basicConstraints=CA:TRUE > > > + subjectKeyIdentifier=12345678 > > > + authorityKeyIdentifier=keyid:always,issuer > > > EOF > > > fi > > > > On my system: > > $ openssl version > > OpenSSL 1.1.1g FIPS 21 Apr 2020 > > > > Not sure this has anything to do with the reason that "skid" is not > > supported. The resulting files are empty. > > > > ls -lat *skid* > > -rw-rw-r--. 1 mimi mimi 0 Jul 14 12:02 test-rsa1024_skid.key > > -rw-rw-r--. 1 mimi mimi 0 Jul 14 12:02 test-rsa1024_skid.pub > > > > - openssl pkey -in test-rsa1024.key -out test-rsa1024.pub -pubout > > - openssl req -verbose -new -nodes -utf8 -sha1 -days 10000 -batch -x509 > > -extensions skid -config test-ca.conf -newkey rsa:1024 -out test- > > rsa1024_skid.cer -outform DER -keyout test-rsa1024_skid.key > > Using configuration from test-ca.conf > > Error Loading extension section skid <=== > > Is it reproducible? Since multiple-distributions CI passed, I wonder > what distro it is. I'm running the tests locally on RHEL 8.4 and Fedora 34 rawhide systems. When generating the keys, the output is redirected to /dev/null. The end result is that the test is simply skipped. sign_verify.test: ./gen-keys.sh >/dev/null 2>&1 [On Fedora: $ openssl version OpenSSL 1.1.1k FIPS 25 Mar 2021] Mimi
