Hot answers tagged

4

It is not possible to specify a SAN in OpenSSL solely at the command line*. FWIW, I wrote a wrapper that allows you to do that by dynamically generating a temporary openssl.cnf behind the scenes for you: one_genkey A script for creating Certificate Signing Requests from the CLI, hiding the OpenSSL config file complexity. *Per dave_thompson_085's ...


3

This logic is in the configuration (i.e. openssl.cnf) only. There is likely something like countryName = match in it. It makes sense to have such policy for a company CA where the company is only in a single state (and such policy is often together with organizationName = match). But it does not make sense for a some globally acting CA which issues ...


2

You put self signed with a question mark without making clear if you understand what it means, namely a cert signed by the same key it contains (not just one you signed or caused to be signed). Or to be more exact, a cert signed by the private half of the keypair whose public half is contained in the cert, so that it verifies with its own key, although that ...


2

Well, as I was pointed at nginx mailing list, nginx removes all environment variables inherited from its parent process except the TZ variable, so once I defined needed variables in nginx.conf env LD_PRELOAD=/usr/local/lib/libsslkeylog.so; env SSLKEYLOGFILE=/tmp/premaster.txt; keys started being recorded as expected.


Only top voted, non community-wiki answers of a minimum length are eligible