Attention is currently required from: Arne Schwabe.
Hello Arne Schwabe,
I'd like you to do a code review.
Please visit
https://gerrit.openvpn.net/c/openvpn/+/2009?usp=email
to review the following change.
Change subject: gen-sample-keys.sh: Don't apply server extensions to CSRs
......................................................................
gen-sample-keys.sh: Don't apply server extensions to CSRs
Newer OpenSSL versions refuse to add authorityKeyIdentifier with
issuer:always to a CSR, since there is no issuer certificate yet. The
extensions are already applied when signing with 'openssl ca', so drop
them from the 'openssl req' calls.
Change-Id: I3513563f199e1c5ac98219a527695e40540a9f73
Signed-off-by: Steffan Karger <[email protected]>
---
M sample/sample-keys/gen-sample-keys.sh
1 file changed, 1 insertion(+), 3 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/09/2009/1
diff --git a/sample/sample-keys/gen-sample-keys.sh
b/sample/sample-keys/gen-sample-keys.sh
index fa5f697..e5a11f5 100755
--- a/sample/sample-keys/gen-sample-keys.sh
+++ b/sample/sample-keys/gen-sample-keys.sh
@@ -31,7 +31,7 @@
-config openssl.cnf
# Create server key and cert
-openssl req -new -nodes -config openssl.cnf -extensions server \
+openssl req -new -nodes -config openssl.cnf \
-keyout sample-ca/server.key -out sample-ca/server.csr \
-subj
"/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server/[email protected]"
openssl ca -batch -config openssl.cnf -extensions server \
@@ -66,7 +66,6 @@
openssl dsaparam -out sample-ca/dsaparams.pem 2048
openssl req -new -newkey dsa:sample-ca/dsaparams.pem -nodes -config
openssl.cnf \
- -extensions server \
-keyout sample-ca/server-dsa.key -out sample-ca/server-dsa.csr \
-subj
"/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server-DSA/[email protected]"
openssl ca -batch -config openssl.cnf -extensions server \
@@ -82,7 +81,6 @@
openssl ecparam -out sample-ca/secp256k1.pem -name secp256k1
openssl req -new -newkey ec:sample-ca/secp256k1.pem -nodes -config openssl.cnf
\
- -extensions server \
-keyout sample-ca/server-ec.key -out sample-ca/server-ec.csr \
-subj
"/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server-EC/[email protected]"
openssl ca -batch -config openssl.cnf -extensions server \
--
To view, visit https://gerrit.openvpn.net/c/openvpn/+/2009?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I3513563f199e1c5ac98219a527695e40540a9f73
Gerrit-Change-Number: 2009
Gerrit-PatchSet: 1
Gerrit-Owner: Steffan Karger <[email protected]>
Gerrit-Reviewer: Arne Schwabe <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: Arne Schwabe <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
