In using openssl req command line, I want complete control over the start and stop dates. In my [ CA_default ] I have default_startdate = 230501000000Z default_enddate = 240601000000Z My openssl command is: openssl req -config $dir/openssl-root.cnf\ -set_serial 0x$(openssl rand -hex $sn)\ -keyform $format -outform $format\ -key $dir/private/ca.key.$format -subj "$DN"\ -new -x509 -extensions v3_ca\ -out $dir/certs/ca.cert.$format $format = pem; $dir is my working dir for this; $sn=8 But the dates show up as: Validity Not Before: May 11 14:14:55 2023 GMT Not After : Jun 10 14:14:55 2023 GMT using the default of 30 days. What am I missing here? thanks Oh here is my config file for reference: # OpenSSL root CA configuration file. # Copy to `$dir/openssl-root.cnf`. [ ca ] # `man ca` default_ca = CA_default [ CA_default ] # Directory and file locations. dir = $ENV::dir cadir = $ENV::cadir format = $ENV::format certs = $dir/certs crl_dir = $dir/crl new_certs_dir = $dir/newcerts database = $dir/index.txt serial = $dir/serial RANDFILE = $dir/private/.rand # The root key and root certificate. private_key = $cadir/private/ca.key.$format certificate = $cadir/certs/ca.cert.$format # For certificate revocation lists. crlnumber = $dir/crlnumber crl = $dir/crl/ca.crl.pem crl_extensions = crl_ext default_crl_days = 30 # SHA-1 is deprecated, so use SHA-2 instead. default_md = sha256 name_opt = ca_default cert_opt = ca_default #default_startdate = $ENV::startdate #default_enddate = $ENV::enddate default_startdate = 230501000000Z default_enddate = 240601000000Z preserve = no policy = policy_strict copy_extensions = copy [ policy_strict ] # The root CA should only sign intermediate certificates that match. # See the POLICY FORMAT section of `man ca`. countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = optional [ policy_loose ] # Allow the intermediate CA to sign a more # diverse range of certificates. # See the POLICY FORMAT section of the `ca` man page. countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = optional [ req ] # Options for the `req` tool (`man req`). default_bits = 2048 distinguished_name = req_distinguished_name string_mask = utf8only req_extensions = req_ext # SHA-1 is deprecated, so use SHA-2 instead. default_md = sha256 # Extension to add when the -x509 option is used. x509_extensions = v3_ca [ req_distinguished_name ] # See <https://en.wikipedia.org/wiki/Certificate_signing_request>. countryName = Country Name (2 letter code) stateOrProvinceName = State or Province Name localityName = Locality Name 0.organizationName = Organization Name organizationalUnitName = Organizational Unit Name commonName = Common Name # Optionally, specify some defaults. # countryName_default = US # stateOrProvinceName_default = MI # localityName_default = Oak Park # 0.organizationName_default = HTT Consulting # organizationalUnitName_default = [ req_ext ] # subjectAltName = $ENV::subjectAltName [ v3_ca ] # Extensions for a typical CA (`man x509v3_config`). subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer basicConstraints = critical, CA:true # keyUsage = critical, digitalSignature, cRLSign, keyCertSign keyUsage = critical, cRLSign, keyCertSign # subjectAltName = $ENV::subjectAltName [ v3_intermediate_ca ] # Extensions for a typical intermediate CA (`man x509v3_config`). subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer basicConstraints = critical, CA:true, pathlen:0 # keyUsage = critical, digitalSignature, cRLSign, keyCertSign keyUsage = critical, cRLSign, keyCertSign [ crl_ext ] # Extension for CRLs (`man x509v3_config`). authorityKeyIdentifier=keyid:always [ ocsp ] # Extension for OCSP signing certificates (`man ocsp`). basicConstraints = CA:FALSE subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer keyUsage = critical, digitalSignature extendedKeyUsage = critical, OCSPSigning
