Hi, (Sorry if some of my terminology is wrong - What I understand of X.509 certs I've picked up working with OpenSSL to set up IPSec and SSL tunnels.)
I've been working on getting SSH Sentinel to talk to the Linux FreeS/WAN IPSec implementation, and am at the stage where I want to get Sentinel to fetch CRLs automatically. To make a long story short, at http://pki.ssh.com:8080/enroll-ca-list.html ssh.com provides some test CAs whose certificates include crlDistributionPoints extensions of type DirName, and I infer that I must do something similar to get Sentinel to fetch the CRLs automatically (as it supports only LDAP for this). Is this possible with OpenSSL? Into the usr_cert section of openssl.cnf I've put crlDistributionPoints = DirName:/C=FI/O=SSH Communications Security Corp/CN=SSH Test CA 2 No Liabilities and when I attempt to use openssl ca to sign the certificate I get: # openssl ca -in req.pem -out cert.pem Using configuration from /usr/share/ssl/openssl.cnf Enter PEM pass phrase: Error Loading extension section usr_cert 6355:error:22075075:X509 V3 routines:v2i_GENERAL_NAME:unsupported option:v3_alt.c:380:name=DirName 6355:error:2206B080:X509 V3 routines:X509V3_EXT_conf:error in extension:v3_conf.c:91:name=crlDistributionPoints, value=DirName:/C=FI/O=SSH Communications Security Corp/CN=SSH Test CA 2 No Liabilities >From my reading of the source code it appears that I can only use email, URI, DNS, RID, and IP type values for this extension. Is there some other way to get a value of type DirName into this extension? Thanks very much :) -- | Mike Acar | [EMAIL PROTECTED] | ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
