Force a subordinate CA cert to be signed to include a the CRL distribution point extension?

Question

How can I attach a crlDistributionPoints parameter when signing a CSR I've generated as follows:

openssl req -new -key /root/ca/private/private.key -out /root/public.csr

I usually sign with:

openssl ca -extensions v3_ca -days 730 -out /root/ca/certs/public.cer -in /root/public.csr

When I attempt to use -extfile to assign a file I've populated with a crlDistributionPoints parameter, clearly signing fails. According to the man page for openssl ca, this is because -extensions refers to -extfile for the configuration profile (in this case v3_ca). Is this correct?

If so, how do I build out a config that contains crlDistributionPoints for use with ca?

I suppose I don't understand the modular design of the configs well, and am concerned that utilizing ca will not work the way I would guess if I write my own openssl.cfg?

Answer 1

I've reviewed the contents of /etc/pki/tls/openssl.cnf, and the following should work to produce a usable -extfile for use with the previously mentioned command (openssl ca -extensions v3_ca -extfile /root/ca/opensslx509.conf -days 730 -out /root/ca/certs/public.cer -in /root/public.csr).

echo "[ v3_ca ]" > /root/ca/opensslx509.conf
echo "subjectKeyIdentifier=hash >> /root/ca/opensslx509.conf
echo "authorityKeyIdentifier=keyid:always,issuer >> /root/ca/opensslx509.conf
echo "basicConstraints = CA:true >> /root/ca/opensslx509.conf
echo "crlDistributionPoints=URI:http://CRLSERVER/CRL.pem" >> /root/ca/opensslx509.conf

I have not tested this at this point.