Add v3_ca extension when generating CA.

2017-03-05 15:11:54 +01:00 · 2017-03-05 15:11:54 +01:00 · 1d294c2463
parent 6a0f7712b0
commit 1d294c2463
2 changed files with 6 additions and 0 deletions
--- a/openssl.cnf
+++ b/openssl.cnf
@ -29,6 +29,11 @@ emailAddress            = supplied
 default_bits            = 2048
 distinguished_name      = req_distinguished_name

+[ v3_ca ]
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid:always,issuer:always
+basicConstraints = CA:true
+
 [ req_distinguished_name ]
 countryName                     = Country Name (2 letter code)
 countryName_default             = FR
--- a/shellpki.sh
+++ b/shellpki.sh
@ -35,6 +35,7 @@ $OPENSSL genrsa  -out $PREFIX/ca/private.key 2048
 $OPENSSL req            	    \
    -config $CONFFILE		    \
    -new -x509 -days 3650      	    \
+    -extensions v3_ca               \
    -keyout $PREFIX/ca/private.key  \
    -out $PREFIX/ca/cacert.pem