Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I attach a crlDistributionPoints parameter when signing a CSR I've generated as follows:

openssl req -new -key /root/ca/private/private.key -out /root/public.csr

I usually sign with:

openssl ca -extensions v3_ca -days 730 -out /root/ca/certs/public.cer -in /root/public.csr

When I attempt to use -extfile to assign a file I've populated with a crlDistributionPoints parameter, clearly signing fails. According to the man page for openssl ca, this is because -extensions refers to -extfile for the configuration profile (in this case v3_ca). Is this correct?

If so, how do I build out a config that contains crlDistributionPoints for use with ca?

I suppose I don't understand the modular design of the configs well, and am concerned that utilizing ca will not work the way I would guess if I write my own openssl.cfg?

share|improve this question
The following similar question may help you… – munkeyoto Jun 3 '13 at 20:06
Thanks. I actually read over that before posting here. I do not believe that it applies directly to signing a subordinate CA certificate, and this was my concern. Unless it does. – mbrownnyc Jun 3 '13 at 20:25

I've reviewed the contents of /etc/pki/tls/openssl.cnf, and the following should work to produce a usable -extfile for use with the previously mentioned command (openssl ca -extensions v3_ca -extfile /root/ca/opensslx509.conf -days 730 -out /root/ca/certs/public.cer -in /root/public.csr).

echo "[ v3_ca ]" > /root/ca/opensslx509.conf
echo "subjectKeyIdentifier=hash >> /root/ca/opensslx509.conf
echo "authorityKeyIdentifier=keyid:always,issuer >> /root/ca/opensslx509.conf
echo "basicConstraints = CA:true >> /root/ca/opensslx509.conf
echo "crlDistributionPoints=URI:http://CRLSERVER/CRL.pem" >> /root/ca/opensslx509.conf

I have not tested this at this point.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.