From a6b90523e4ea6010b1109b0bae7e2a73b5b025c5 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Sun, 25 Sep 2022 11:39:55 +0200 Subject: [PATCH] updating CA constraints --- tcl_tests/ossltest.tcl | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/tcl_tests/ossltest.tcl b/tcl_tests/ossltest.tcl index 792c071..ed657d6 100644 --- a/tcl_tests/ossltest.tcl +++ b/tcl_tests/ossltest.tcl @@ -220,11 +220,33 @@ CN=Test CA $algor_with_par O=Cryptocom OU=OpenSSL CA emailAddress = openssl@cryptocom.ru +\[ v3_ca \] +# Extensions for a typical CA +# PKIX recommendation. +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid:always,issuer +basicConstraints = critical,CA:true + +# Key usage: this is typical for a CA certificate. However since it will +# prevent it being used as an test self-signed certificate it is best +# left out by default. +# keyUsage = cRLSign, keyCertSign + +# Include email address in subject alt name: another PKIX recommendation +# subjectAltName=email:copy +# Copy issuer details +# issuerAltName=issuer:copy + +# DER hex encoding of an extension: beware experts only! +# obj=DER:02:03 +# Where 'obj' is a standard or added object +# You can even override a supported extension: +# basicConstraints= critical, DER:30:03:01:01:FF " file mkdir $CAname/private file mkdir $CAname/newcerts generate_key [keygen_params $algor_with_par] $CAname/private/cakey.pem - openssl "req -new -x509 -key $CAname/private/cakey.pem -nodes -out $CAname/cacert.pem -config $CAname/req.conf -set_serial 0x11E" + openssl "req -new -x509 -key $CAname/private/cakey.pem -nodes -out $CAname/cacert.pem -config $CAname/req.conf -reqexts v3_ca -set_serial 0x11E" makeFile ./$CAname/.rand 1234567890 makeFile ./$CAname/serial 011E makeFile ./$CAname/index.txt "" -- 2.39.5