Hi Patrick, Thanks a lot for your explanation. It was certainly insightfull.
Warm Regards, Mário Gamito On Thu, May 8, 2008 at 2:35 PM, Patrick Patterson <[EMAIL PROTECTED]> wrote: > > On May 8, 2008 06:09:01 am Mário Gamito wrote: > > Hi, > > > > I use to create my SSL certificates for Apache with the following commands: > > > > # openssl genrsa -des3 -out ca.key 1024 > > # openssl req -new -x509 -days 365 -key ca.key -out ca.crt > > # openssl genrsa -des3 -out server.key 1024 > > # openssl req -new -key server.key -out server.csr > > > > After this, I sign server.csr with the sign.sh script from mod_ssl. > > > > Until now, I've only sent certificates for companies to sign with only > > two letters in the top domais, like .pt or .uk > > But today, i need to create a certificate for a .net domain but in the > > first question of the second and fourth commands (about the domain > > name), it doesn't accept more than two letters. > > > > So, my question, as you may already have guessed is how do I create a > > certificate for a .net domain ? > > > Take a look in the openssl.cnf file - in the Request section there is > probably > something similar to the following: > > countryName = Country Name (2 letter code) > countryName_default = CA > countryName_min = 2 > countryName_max = 2 > > > Don't change it - I think that what you are confused about, is that this > refers to the country attribute of the X.500 DN (C=), not the suffix to the > Internet DNS name. > > The Country Attribute is, IIRC, defined as the 2 letter ISO country code. > Most > of the time, it is supposed to be the country either where the server is > located, where the company that owns that domain is located, or where the CA > operates (depending on the policy of the CA). If you try and change it, you > will be generating incorrect X.500 Distinguished Names, and some applications > may not work. > > So - the only place in a server cert that should have a Fully Qualified > Domain > Name (the DNS name) is in the last Common Name Field. > > So, it is perfectly OK to have a DN with: > > C=UK,O=Example Widget Inc.,OU=Internet Operations, CN=www.example.com > > In which case, just put in the right country code when it asks you for > Country, and the FQDN when it asks you for common name. > > BTW: A lot of Certificate Providers completely ignore whatever you give them > as a DN aside from the Common Name field, so changing the [req] section of > the openssl.cnf file to be just: > > [req] > commonName = The FQDN of the Server > commonName_max = 64 > > should actually work just fine (YYMV). > > Have fun. > > -- > Patrick Patterson > President and Chief PKI Architect, > Carillon Information Security Inc. > http://www.carillon.ca > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > User Support Mailing List [email protected] > Automated List Manager [EMAIL PROTECTED] > ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
