From: Steffan Karger <[email protected]> Newer OpenSSL versions refuse to add authorityKeyIdentifier with issuer:always to a CSR, since there is no issuer certificate yet. The extensions are already applied when signing with 'openssl ca', so drop them from the 'openssl req' calls.
Change-Id: I3513563f199e1c5ac98219a527695e40540a9f73 Signed-off-by: Steffan Karger <[email protected]> Acked-by: Razvan Cojocaru <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2009 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2009 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru <[email protected]> diff --git a/sample/sample-keys/gen-sample-keys.sh b/sample/sample-keys/gen-sample-keys.sh index fa5f697..e5a11f5 100755 --- a/sample/sample-keys/gen-sample-keys.sh +++ b/sample/sample-keys/gen-sample-keys.sh @@ -31,7 +31,7 @@ -config openssl.cnf # Create server key and cert -openssl req -new -nodes -config openssl.cnf -extensions server \ +openssl req -new -nodes -config openssl.cnf \ -keyout sample-ca/server.key -out sample-ca/server.csr \ -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server/[email protected]" openssl ca -batch -config openssl.cnf -extensions server \ @@ -66,7 +66,6 @@ openssl dsaparam -out sample-ca/dsaparams.pem 2048 openssl req -new -newkey dsa:sample-ca/dsaparams.pem -nodes -config openssl.cnf \ - -extensions server \ -keyout sample-ca/server-dsa.key -out sample-ca/server-dsa.csr \ -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server-DSA/[email protected]" openssl ca -batch -config openssl.cnf -extensions server \ @@ -82,7 +81,6 @@ openssl ecparam -out sample-ca/secp256k1.pem -name secp256k1 openssl req -new -newkey ec:sample-ca/secp256k1.pem -nodes -config openssl.cnf \ - -extensions server \ -keyout sample-ca/server-ec.key -out sample-ca/server-ec.csr \ -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server-EC/[email protected]" openssl ca -batch -config openssl.cnf -extensions server \ _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
