Here's a background of what I've done so far:
I've been able to add a CRL to a self signed certificate using OpenSSL (see attached). But I'm not sure how to create an X.509 certificate issued by this self-signed root (i.e. a leaf certificates from this CA)
I've tried to create a leaf certificate from this CA using
openssl req -new -nodes -out leafcert.pem -keyout private/leaf-key.pem -days 365, but I haven't been able to determine if the CRL is in this certificate... I've used the openSSL command:
openssl req -text -noout -verify -in leafcert.pem
But all I can see is the following:
verify OK Certificate Request: Data: Version: 0 (0x0) Subject: C=US, ST=DC, L=Washington, O=Norkie, OU=Test, CN=Leaf/emailAddressfirstname.lastname@example.org Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:c0:32:a0:f5:7e:59:86:9e:97:0c:a0:4b:65:38: 58:af:aa:44:86:8c:8f:2a:0a:89:e0:40:ee:8d:8e: 68:7d:e2:52:46:e8:19:e2:52:58:1f:a6:6c:d0:1d: 55:47:79:e2:f4:ff:b8:ff:7d:3e:80:cf:24:74:4d: 85:48:28:74:f4:71:13:2a:4d:cb:53:7f:b1:bb:d9: fa:5e:8e:41:2b:ea:f8:ba:38:84:15:58:78:d9:44: 45:aa:af:54:55:71:f7:2b:74:1b:d5:18:e0:ad:af: c8:fa:d8:3a:9e:1b:47:3a:a5:16:a1:1c:ff:bb:77: da:df:49:2c:fc:ac:2c:64:c5 Exponent: 65537 (0x10001) Attributes: challengePassword :akronohio Signature Algorithm: sha1WithRSAEncryption 9e:b8:d0:af:02:ee:0e:85:a4:f7:85:ff:6d:0a:94:41:d9:c9: f6:ba:ff:d4:91:84:45:6d:8e:52:fe:f9:30:bf:12:59:86:7c: ce:90:04:a1:3b:6f:71:99:16:ed:27:da:a6:f0:8f:f3:b6:f3: bd:0f:c1:68:35:3d:f0:22:60:b3:71:69:bb:71:6d:63:31:d9: 05:0e:50:e2:53:d9:a3:af:08:b9:ae:50:03:f4:37:cd:a3:08: 6c:3d:88:97:cf:34:47:2c:b8:2b:fa:82:ba:66:fb:b1:cc:82: 38:bb:16:6b:50:d9:da:03:44:a7:b5:e5:a3:47:e5:a6:6b:8f: f3:69
It doesn't tell me who the leaf is issued by and if it has any crlDistributionPoints.