8

How can I attach a crlDistributionPoints parameter when signing a CSR I've generated as follows:

openssl req -new -key /root/ca/private/private.key -out /root/public.csr

I usually sign with:

openssl ca -extensions v3_ca -days 730 -out /root/ca/certs/public.cer -in /root/public.csr

When I attempt to use -extfile to assign a file I've populated with a crlDistributionPoints parameter, clearly signing fails. According to the man page for openssl ca, this is because -extensions refers to -extfile for the configuration profile (in this case v3_ca). Is this correct?

If so, how do I build out a config that contains crlDistributionPoints for use with ca?

I suppose I don't understand the modular design of the configs well, and am concerned that utilizing ca will not work the way I would guess if I write my own openssl.cfg?

Improve this question
2
  • The following similar question may help you stackoverflow.com/questions/11966123/…
    – munkeyoto
    Jun 3, 2013 at 20:06
  • Thanks. I actually read over that before posting here. I do not believe that it applies directly to signing a subordinate CA certificate, and this was my concern. Unless it does.
    – mbrownnyc
    Jun 3, 2013 at 20:25

1 Answer 1

Reset to default
1

I've reviewed the contents of /etc/pki/tls/openssl.cnf, and the following should work to produce a usable -extfile for use with the previously mentioned command (openssl ca -extensions v3_ca -extfile /root/ca/opensslx509.conf -days 730 -out /root/ca/certs/public.cer -in /root/public.csr).

echo "[ v3_ca ]" > /root/ca/opensslx509.conf
echo "subjectKeyIdentifier=hash >> /root/ca/opensslx509.conf
echo "authorityKeyIdentifier=keyid:always,issuer >> /root/ca/opensslx509.conf
echo "basicConstraints = CA:true >> /root/ca/opensslx509.conf
echo "crlDistributionPoints=URI:http://CRLSERVER/CRL.pem" >> /root/ca/opensslx509.conf

I have not tested this at this point.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.