Gert Doering has submitted this change. ( https://gerrit.openvpn.net/c/openvpn/+/2009?usp=email )
Change subject: gen-sample-keys.sh: Don't apply server extensions to CSRs ...................................................................... gen-sample-keys.sh: Don't apply server extensions to CSRs Newer OpenSSL versions refuse to add authorityKeyIdentifier with issuer:always to a CSR, since there is no issuer certificate yet. The extensions are already applied when signing with 'openssl ca', so drop them from the 'openssl req' calls. Change-Id: I3513563f199e1c5ac98219a527695e40540a9f73 Signed-off-by: Steffan Karger <[email protected]> Acked-by: Razvan Cojocaru <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2009 Message-Id: <[email protected]> URL: https://www.mail-archive.com/[email protected]/msg39973.html Signed-off-by: Gert Doering <[email protected]> --- M sample/sample-keys/gen-sample-keys.sh 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/sample/sample-keys/gen-sample-keys.sh b/sample/sample-keys/gen-sample-keys.sh index fa5f697..e5a11f5 100755 --- a/sample/sample-keys/gen-sample-keys.sh +++ b/sample/sample-keys/gen-sample-keys.sh @@ -31,7 +31,7 @@ -config openssl.cnf # Create server key and cert -openssl req -new -nodes -config openssl.cnf -extensions server \ +openssl req -new -nodes -config openssl.cnf \ -keyout sample-ca/server.key -out sample-ca/server.csr \ -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server/[email protected]" openssl ca -batch -config openssl.cnf -extensions server \ @@ -66,7 +66,6 @@ openssl dsaparam -out sample-ca/dsaparams.pem 2048 openssl req -new -newkey dsa:sample-ca/dsaparams.pem -nodes -config openssl.cnf \ - -extensions server \ -keyout sample-ca/server-dsa.key -out sample-ca/server-dsa.csr \ -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server-DSA/[email protected]" openssl ca -batch -config openssl.cnf -extensions server \ @@ -82,7 +81,6 @@ openssl ecparam -out sample-ca/secp256k1.pem -name secp256k1 openssl req -new -newkey ec:sample-ca/secp256k1.pem -nodes -config openssl.cnf \ - -extensions server \ -keyout sample-ca/server-ec.key -out sample-ca/server-ec.csr \ -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server-EC/[email protected]" openssl ca -batch -config openssl.cnf -extensions server \ -- To view, visit https://gerrit.openvpn.net/c/openvpn/+/2009?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I3513563f199e1c5ac98219a527695e40540a9f73 Gerrit-Change-Number: 2009 Gerrit-PatchSet: 2 Gerrit-Owner: Steffan Karger <[email protected]> Gerrit-Reviewer: Arne Schwabe <[email protected]> Gerrit-Reviewer: Răzvan Cojocaru <[email protected]> Gerrit-CC: openvpn-devel <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
