Re: [openssl-users] How do I configure my Certification Authority to pay attention to Subject Alternate Names

[Walter H.]

On 03.11.2015 18:45, John Lewis wrote:

On 11/03/2015 12:04 PM, Walter H. wrote:

On 03.11.2015 14:46, John Lewis wrote:

I created a local certification authority  using this tutorial

https://www.debian-administration.org/article/284/Creating_and_Using_a_self_signed__SSL_Certificates_in_debian

and made a certification request using this tutorial and I use this
tutorial to learn how to make a request with a Subject Alternate Name.

I actually did manage to get lucky just now and I hypothesize that
running a command like this 'openssl ca -in ldap01.req -out
certs/new/ldap04.pem -extensions v3_req -config ./openssl.cnf' as
opposed to running a command like this 'openssl ca -in ldap01.req -out
certs/new/ldap04.pem  -config ./openssl.cnf' got my CA to create a cert

configuration and have it be not be ignored?

with subject alternate names. How do I add '-extensions v3_req' to my ca

add the following parameter(s):

-extensions sslcertext -extfile file
this file is similar to the following

[ sslcertext ]
basicConstraints = CA:false
keyUsage = critical, digitalSignature, keyEncipherment
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer:always


issuerAltName = issuer:copy
subjectAltName = #SUBJECTALTNAME#

extendedKeyUsage = serverAuth, msSGC, nsSGC

certificatePolicies = ia5org, @policy_section
crlDistributionPoints = URI:#CRL-URL#

[ policy_section ]
policyIdentifier = #POLICYID#
CPS.1 = #CPS-URL#

authorityInfoAccess = OCSP;URI:#OCSP-URL#/, caIssuers;URI:#DER-CACERT-URL#

Do I replace my current [v3_req] section with the contents of [sslcertext]

No, you add this part, because v3_req is used for the certificate request ...

and I have forgotten to mention, that #...# must be replaced with the right values;

smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users