Your message dated Sat, 01 Aug 2026 15:48:57 +0000
with message-id <[email protected]>
and subject line Bug#929121: fixed in ssl-cert 1.2.0
has caused the Debian Bug report #929121,
regarding ssl-cert: Please produce separate key/pem files for the
'non-snakeoil' case
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
929121: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929121
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: ssl-cert
Version: 1.0.39
Severity: normal
Dear Maintainer,
using the script to create a custom self-signed cert, for example like so
# make-ssl-cert /usr/share/ssl-cert/ssleay.cnf cert.pem
produces only one file, cert.pem, containing both the public and the
private key (script uses same file arg for --out and --keyout).
This is, at least, not useful out-of-the box. I would expect the
script to produce private and public key in separate files (like for
the snakeoil case).
The attached patch is a suggestion, assuming the script argument as
stem and creating separate .pem/.key files (ideally however, both
filenames can be given as argument).
Hth!
S
-- System Information:
Debian Release: 10.0
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 4.19.0-0.bpo.4-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C.UTF-8
(charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages ssl-cert depends on:
ii adduser 3.118
ii debconf [debconf-2.0] 1.5.72
ii openssl 1.1.1b-2
ssl-cert recommends no packages.
Versions of packages ssl-cert suggests:
pn openssl-blacklist <none>
-- debconf information excluded
commit edb701ff5440a09dc90f07038965f3c154fd8358
Author: Stephan Sürken <[email protected]>
Date: Fri May 17 14:02:03 2019 +0200
make-ssl-cert[.8]: Make script work for the non-snakeoil case.
diff --git a/make-ssl-cert b/make-ssl-cert
index 152e9f9..45bcac7 100755
--- a/make-ssl-cert
+++ b/make-ssl-cert
@@ -104,16 +104,17 @@ umask 077
if [ "$1" != "generate-default-snakeoil" ]; then
if ! openssl req -config $TMPFILE -new -x509 -days 3650 -nodes -sha256 \
- -out $output -keyout $output > $TMPOUT 2>&1
+ -out ${output}.pem -keyout ${output}.key > $TMPOUT 2>&1
then
echo Could not create certificate. Openssl output was: >&2
cat $TMPOUT >&2
exit 1
fi
- chmod 600 $output
+ chmod 600 $output.key
+ chmod 644 $output.pem
# hash symlink
- cd $(dirname $output)
- ln -sf $(basename $output) $(openssl x509 -hash -noout -in $(basename
$output))
+ cd $(dirname $output.pem)
+ ln -sf $(basename $output.pem) $(openssl x509 -hash -noout -in $(basename
$output.pem))
else
if ! openssl req -config $TMPFILE -new -x509 -days 3650 -nodes -sha256 \
-out /etc/ssl/certs/ssl-cert-snakeoil.pem \
diff --git a/make-ssl-cert.8 b/make-ssl-cert.8
index 7916b25..a384a7e 100644
--- a/make-ssl-cert.8
+++ b/make-ssl-cert.8
@@ -3,7 +3,7 @@
make-ssl-cert - Debconf wrapper for openssl
.SH SYNOPSIS
.B make-ssl-cert
-\fItemplate\fR \fIoutput-certificate\fR [\fB\-\-force\-overwrite\fR]
+\fItemplate\fR \fIoutput-certificate-base\fR [\fB\-\-force\-overwrite\fR]
.br
.B make-ssl-cert generate-default-snakeoil
[\fB\-\-force\-overwrite\fR]
@@ -11,9 +11,9 @@ make-ssl-cert - Debconf wrapper for openssl
.SH "DESCRIPTION"
make-ssl-cert is a simple debconf to openssl wrapper to create self-signed
certificates.
-It requires a source template (Ex: /usr/share/ssl-cert/ssleay.cnf)
-and it will place the new generated certificate in the specified
-output file.
+It requires a source template (Ex: /usr/share/ssl-cert/ssleay.cnf) and
+it will place the new generated certificate in resp. file appendixed .pem
+(public cert) and .key (private key) from the given base name.
.br
Invoked with "generate-default-snakeoil", it will generate
/etc/ssl/certs/ssl-cert-snakeoil.pem and
/etc/ssl/private/ssl-cert-snakeoil.key.
--- End Message ---
--- Begin Message ---
Source: ssl-cert
Source-Version: 1.2.0
Done: Stefan Fritsch <[email protected]>
We believe that the bug you reported is fixed in the latest version of
ssl-cert, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Stefan Fritsch <[email protected]> (supplier of updated ssl-cert package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 01 Aug 2026 17:20:31 +0200
Source: ssl-cert
Architecture: source
Version: 1.2.0
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers <[email protected]>
Changed-By: Stefan Fritsch <[email protected]>
Closes: 904686 929121
Changes:
ssl-cert (1.2.0) unstable; urgency=medium
.
[ Stefan Fritsch ]
* Bump standards-version and remove Priority from control file
* Increase default key length to 3072, but don't replace existing
2048 bit keys. Closes: #904686
* Enable Salsa-CI
* Allow separate key/cert files for the non generate-default-snakeoil
case, too. Closes: #929121
* Allow to override CN and SubjectAltName from command line.
.
[ Luca Boccassi ]
* Install and use sysusers.d config file instead of adduser for the
ssl-cert group.
Checksums-Sha1:
ebfc48d574453dd32e6cf5e6ee6bbbba697eaff7 1645 ssl-cert_1.2.0.dsc
6d07dd27dd09dcacd60d4353616b532364f558a4 33344 ssl-cert_1.2.0.tar.xz
d8051d4532fdc130e06840d9c2340ec83ab91b1f 7085 ssl-cert_1.2.0_source.buildinfo
Checksums-Sha256:
bdb935dd6cb613ac55e0d637738c286e226d76df21f28c48cb9b534582cf4961 1645
ssl-cert_1.2.0.dsc
2615b043c1d692f8ce64e72e3e9acf6c0fff92cfb899e53e98226ef4031f150a 33344
ssl-cert_1.2.0.tar.xz
33cb20fc58feb9f8be31efe73f1c307269293aacdad20f473c4a1f55e3ce8738 7085
ssl-cert_1.2.0_source.buildinfo
Files:
473cede5d7fad1259844c02a0c711719 1645 utils optional ssl-cert_1.2.0.dsc
d3397258772729e57dc86feb18793085 33344 utils optional ssl-cert_1.2.0.tar.xz
c3373a38f78801a184ec071d1fb6e304 7085 utils optional
ssl-cert_1.2.0_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEOpiNza8JqByyYYsxxodfNUHO/eAFAmpuD3YACgkQxodfNUHO
/eAwRBAAhqUzmIF6ywQyuDS+lWkL97U//wqBK9Fo34uvaqsCPOD9W2B9YHq7UYbh
T6QCaEa9R+ny1xlR0sYw7KQJdE4rhV3abv1avn30YgoQQk+fcsyWuR6Qb90tJd0W
Ha55JspwkhV4IEzmX9VZk9vYvXAhNnBuv+RgVQRSjzajvTOCXMfDGQEMXveU8wbA
0hoH49MoMYc1eYHuD8fw7LHIGwRoE4BSS7hz7aGKLRImnbgZRSDUdlxAZLRaPicY
2TosAYn9euj7uvfifq934bPyvShQEjVmUjzReLWTdl/M5nyFdmOvkWf8JtqWopoY
0UzbF8TJNBMBXfekUsQXwQn/czjDjXiwHDTTB/5fMiTjPGaQA8wS29p3DFvR2m1d
kwn03zHpH8mR+UDJnIlAsXAP/cUHtwR9tQXNixUdeYN6IYL5BaHekGa994WkxVn6
uL7fe6UsrVNV2DdH3SN7XjM0/oppr60ziuLkbq4wU6RA2CuAkqcclkmySIFWs6Lu
fjcn3YNaBTmru/HxSaP/OLwE5j33S74JktgtEsWEGGhzUdw3dzMJvPawTKZ7V+Qe
H4hgm6vMA7b1TllL3cgqoGxa32dNOKQ17dM0SUXwdizyWDD+PPZ92XbK+ISJcPmd
7IY4hbJccHilF27OesuYGeK+30MqJuNlDvhEF5QtAoxQj8qelKs=
=K2RS
-----END PGP SIGNATURE-----
pgp56K8kDAHi5.pgp
Description: PGP signature
--- End Message ---
