Viktor,
thanks for the explanation. Obviously I read more into the man that was
really there:
https://www.openssl.org/docs/man1.1.0/apps/x509.html
So back to openssl ca and deal with no way to directly create a DER
formatted cert.
Definitely a deficiency.
On 08/29/2017 07:25 PM, Viktor Dukhovni wrote:
On Tue, Aug 29, 2017 at 05:36:34PM -0400, Robert Moskowitz wrote:
Another problem. It is almost like it is not reading the CA selction?
Not "almost", but actually as expected, since "openssl x509 -req"
is not the ca(1) application.
openssl x509 -req -extfile $dir/openssl-8021AR.cnf \
-extensions 8021ar_idevid -days 365 -sha256 \
-set_serial 0x$(openssl rand -hex $sn) \
-inform $format -in $dir/csr/$DevID.csr.$format \
-outform $format -out $dir/certs/$DevID.cert.$format \
-CAkeyform $format -CAkey $dir/private/8021ARintermediate.key.$format \
-CAform $format -CA $dir/certs/8021ARintermediate.cert.$format
does not. Even if I leave out the -days option.
It just creates a signed certificate based on the command-line
options, with only the extensions (-extfile option) read from a
configuration file. The only concession to ca(1)-like behaviour
is support for a compatible serial number file (likely subject to
race conditions absent external locks to serialize invocations).
* The version is 3, since you're using extensions
* The serial number is specified on the command line.
* The issuer DN is taken from the signing certificate.
* The subject DN and public key are copied from the CSR
That just leaves the dates, and you get to specify the duration
from *now* with "-days".
With "x509 -req" you're building certs pretty much from the ground
up, a short C program will do exactly the same work, and could use
an explicit end date, rather than an increment of 'n' days from
the present.
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
