Hello fellows, at first my truely compliment for our work with OpenSSL. I was trying to fit openssl-0.9.6 on my S.U.S.E. Linux 7.0 and it works! With the openssl req and ca applications I can get certification requests and sign it with rather extensions as described in openssl.cnf examples.
However I didn't success in including and signing attributes and my own OID's. The req man pages explain that openssl passes the attributes in requests without signing. Unfortunately I am not so deep confirm with X509V3 standards and don't know is that a bug or an intension. Maybe in X509V3 is no more place for X509 attributes instead of several X509V3 extensions? In case of OID openssl ca traces the OID-section and their settings in the config file very well but assigning any value to the oid variable in the extension section araise an error. What happens? Browsing the source codes I found that the error occurs in v3_lib.c in the function X509V3_EXT_get_nid: OBJ_bsearch seems to return NULL and ext_list is NULL. On the other side I can't find out, where add_oid_section meets ext_list for setting. Questions over questions... Here my config file fragments: oid_section = new_oids [ new_oids ] TestOID = 2.5.4.12 [ CA ] ... x509_extensions = Usr # The extentions to add to the cert .... [ Usr ] basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment nsComment = "User Certificate" subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer:always TestOID = Test In hope for a friendly answer and with best regards Klaus ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
