How can I attach a crlDistributionPoints
parameter when signing a CSR I've generated as follows:
openssl req -new -key /root/ca/private/private.key -out /root/public.csr
I usually sign with:
openssl ca -extensions v3_ca -days 730 -out /root/ca/certs/public.cer -in /root/public.csr
When I attempt to use -extfile
to assign a file I've populated with a crlDistributionPoints
parameter, clearly signing fails. According to the man page for openssl ca
, this is because -extensions
refers to -extfile
for the configuration profile (in this case v3_ca
). Is this correct?
If so, how do I build out a config that contains crlDistributionPoints
for use with ca
?
I suppose I don't understand the modular design of the configs well, and am concerned that utilizing ca
will not work the way I would guess if I write my own openssl.cfg
?
subordinate CA
certificate, and this was my concern. Unless it does.