From: Steffan Karger <[email protected]> Instead of forcing openssl to create consecutive serial numbers, let it generate random serials. Although not really relevant for the sample keys, that is the best practice.
Signed-off-by: Steffan Karger <[email protected]> Acked-by: Razvan Cojocaru <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2010 Change-Id: Ic36123c5a4a2b2295ffdf47174e2aceb9d17d668 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2010 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru <[email protected]> diff --git a/sample/sample-keys/gen-sample-keys.sh b/sample/sample-keys/gen-sample-keys.sh index e5a11f5..e914fd2 100755 --- a/sample/sample-keys/gen-sample-keys.sh +++ b/sample/sample-keys/gen-sample-keys.sh @@ -22,7 +22,6 @@ mkdir -p sample-ca rm -f sample-ca/index.txt touch sample-ca/index.txt -echo "01" > sample-ca/serial # Generate CA key and cert openssl req -new -newkey rsa:4096 -days 3650 -nodes -x509 \ diff --git a/sample/sample-keys/openssl.cnf b/sample/sample-keys/openssl.cnf index 02bf8ac..dcaebb7 100644 --- a/sample/sample-keys/openssl.cnf +++ b/sample/sample-keys/openssl.cnf @@ -14,7 +14,7 @@ new_certs_dir = $dir # default place for new certs. certificate = $dir/ca.crt # The CA certificate -serial = $dir/serial # The current serial number +rand_serial = yes # Use random serial numbers crl = $dir/crl.pem # The current CRL private_key = $dir/ca.key # The private key RANDFILE = $dir/.rand # private random number file _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
