I am trying to use an environment variable to add a whole line to the
config file. This is to control adding (or not providing) CRL and/or
OCSP support.
export shows:
declare -x crlDP="crlDistributionPoints =
URI:http://www.htt-consult.com/pki/intermediate.crl.pem";
declare -x default_crl_days="default_crl_days = 30"
declare -x ocspIAI="authorityInfoAccess =
OCSP;URI:http://ocsp.htt-consult.com";
The config file starts with:
[ ca ]
# `man ca`
default_ca = CA_default
[ CA_default ]
# Directory and file locations.
dir= $ENV::dir
cadir = $ENV::cadir
format= $ENV::format
crlDP = $ENV::crlDP
default_crl_days = $ENV::default_crl_days
ocspIAI = $ENV::ocspIAI
The usr_cert section has:
[ usr_cert ]
# Extensions for client certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical,nonRepudiation,digitalSignature,keyEncipherment
extendedKeyUsage = clientAuth, emailProtection
$crlDP
$ocspIAI
Note that the line with "$crlDP" is line 123
When I run the command:
openssl req -config $dir/openssl-intermediate.cnf -key
$dir/private/$serverfqdn.key.$format -subj "$DN" -new -sha256
-out $dir/csr/$serverfqdn.csr.$format
I get the error:
req: Error on line 123 of config file
"/home/rgm/ca/intermediate/openssl-intermediate.cnf"
unable to find 'distinguished_name' in config
problems making Certificate Request
3070145488:error:0E06D06A:configuration file
routines:NCONF_get_string:no conf or environment
variable:crypto/conf/conf_lib.c:272:
note that if I:
grep -n distinguished_name openssl-intermediate.cnf
68:distinguished_name = req_distinguished_name
78:[ req_distinguished_name ]
So the warning about unable to find 'distinguished_name' in config
Is misleading. The problem is more likely with line 123 which is only
the env variable.
I can play around with this and hopefully the variables to work as
crlDistributionPoints = $crlDP
And if $crlDP is empty, it will not put an empty value into the cert.
But why does what I have not work?
thanks
Bob
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
