in openssl.0.9.2b,i make a test like after:
1.CA.sh -newca
# make a new CA and ca cerrificate.
#now in ../lib/openssl.cnf,
# section[v3_ca] ,basicConstraints = CA:true
2.openssl req -new -nodes -out 01.csr -keyout 01.key
3.openssl ca -in 01.csr -out 01.pem
#now in ../lib/openssl.cnf ,
#section [usr_cert] ,
#basicConstraints = critical,CA:false
4.openssl req -new -nodes -out 02.csr -keyout 02.key
5.openssl ca -in 02.csr -out 02.pem -cert 01.pem -keyfile 01.key
6.cat ./demoCA/cacert.pem >>01.pem
7.openssl verify -CAfile 01.pem 02.pem
02.pem: OK
i think in step 3 ,i make a ee certificate , and this certificate and
key
can not be used to be a CA , but in step 5 ,the certificate can be
a CA,and in step 7 ,verify OK!
am i wrong?
Thanks for any help.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
