> On Jan 13, 2016, at 1:22 PM, Mauro Romano Trajber <[email protected]> wrote: > > In which section? > > On section [CA_default] I have 'copy_extensions = copy'
In case you find it useful, I am attaching a bash script I use to generate certificate chains for various automated tests. This does not use any customized .cnf files, and bypasses the ca(1) utility, just signs directly via "openssl x509 -req" and extension settings created on the fly via "-extfile <(printf ...)".
mkcert
Description: Binary data
The keys created are always EC P-256 keys, but you can change
that part of the script if you want RSA instead.
$ ./mkcert genroot "Root CA" rootkey rootcert
$ ./mkcert genca "Issuer CA" cakey cacert rootkey rootcert
$ ./mkcert genee "$(uname -n)" eekey eecert cakey cacert
$ openssl x509 -in eecert.pem -text -noout | egrep 'DNS:|Subject|Issuer'
Issuer: CN = Issuer CA
Subject: CN = vpro.lan
Subject Public Key Info:
X509v3 Subject Key Identifier:
X509v3 Subject Alternative Name:
DNS:vpro.lan
--
Viktor.
_______________________________________________ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
