On May 8, 2008 06:09:01 am Mário Gamito wrote: > Hi, > > I use to create my SSL certificates for Apache with the following commands: > > # openssl genrsa -des3 -out ca.key 1024 > # openssl req -new -x509 -days 365 -key ca.key -out ca.crt > # openssl genrsa -des3 -out server.key 1024 > # openssl req -new -key server.key -out server.csr > > After this, I sign server.csr with the sign.sh script from mod_ssl. > > Until now, I've only sent certificates for companies to sign with only > two letters in the top domais, like .pt or .uk > But today, i need to create a certificate for a .net domain but in the > first question of the second and fourth commands (about the domain > name), it doesn't accept more than two letters. > > So, my question, as you may already have guessed is how do I create a > certificate for a .net domain ? > Take a look in the openssl.cnf file - in the Request section there is probably something similar to the following:
countryName = Country Name (2 letter code) countryName_default = CA countryName_min = 2 countryName_max = 2 Don't change it - I think that what you are confused about, is that this refers to the country attribute of the X.500 DN (C=), not the suffix to the Internet DNS name. The Country Attribute is, IIRC, defined as the 2 letter ISO country code. Most of the time, it is supposed to be the country either where the server is located, where the company that owns that domain is located, or where the CA operates (depending on the policy of the CA). If you try and change it, you will be generating incorrect X.500 Distinguished Names, and some applications may not work. So - the only place in a server cert that should have a Fully Qualified Domain Name (the DNS name) is in the last Common Name Field. So, it is perfectly OK to have a DN with: C=UK,O=Example Widget Inc.,OU=Internet Operations, CN=www.example.com In which case, just put in the right country code when it asks you for Country, and the FQDN when it asks you for common name. BTW: A lot of Certificate Providers completely ignore whatever you give them as a DN aside from the Common Name field, so changing the [req] section of the openssl.cnf file to be just: [req] commonName = The FQDN of the Server commonName_max = 64 should actually work just fine (YYMV). Have fun. -- Patrick Patterson President and Chief PKI Architect, Carillon Information Security Inc. http://www.carillon.ca ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
