diff mbox series

[Openvpn-devel,v1] gen-sample-keys.sh: Don't apply server extensions to CSRs

Message ID 20261018070320.15749-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] gen-sample-keys.sh: Don't apply server extensions to CSRs |

Commit Message

Gert Doering Oct. 18, 2026, 7:03 a.m. UTC 
  From: Steffan Karger <steffan@karger.me>

Newer OpenSSL versions refuse to add authorityKeyIdentifier with
issuer:always to a CSR, since there is no issuer certificate yet. The
extensions are already applied when signing with 'openssl ca', so drop
them from the 'openssl req' calls.

Change-Id: I3513563f199e1c5ac98219a527695e40540a9f73
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2009
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2009
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <razvanc@mailbox.org>
diff mbox series

Patch

diff --git a/sample/sample-keys/gen-sample-keys.sh b/sample/sample-keys/gen-sample-keys.sh
index fa5f697..e5a11f5 100755
--- a/sample/sample-keys/gen-sample-keys.sh
+++ b/sample/sample-keys/gen-sample-keys.sh
@@ -31,7 +31,7 @@ 
     -config openssl.cnf
 
 # Create server key and cert
-openssl req -new -nodes -config openssl.cnf -extensions server \
+openssl req -new -nodes -config openssl.cnf \
     -keyout sample-ca/server.key -out sample-ca/server.csr \
     -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server/emailAddress=me@myhost.mydomain"
 openssl ca -batch -config openssl.cnf -extensions server \
@@ -66,7 +66,6 @@ 
 openssl dsaparam -out sample-ca/dsaparams.pem 2048
 
 openssl req -new -newkey dsa:sample-ca/dsaparams.pem -nodes -config openssl.cnf \
-    -extensions server \
     -keyout sample-ca/server-dsa.key -out sample-ca/server-dsa.csr \
     -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server-DSA/emailAddress=me@myhost.mydomain"
 openssl ca -batch -config openssl.cnf -extensions server \
@@ -82,7 +81,6 @@ 
 openssl ecparam -out sample-ca/secp256k1.pem -name secp256k1
 
 openssl req -new -newkey ec:sample-ca/secp256k1.pem -nodes -config openssl.cnf \
-    -extensions server \
     -keyout sample-ca/server-ec.key -out sample-ca/server-ec.csr \
     -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server-EC/emailAddress=me@myhost.mydomain"
 openssl ca -batch -config openssl.cnf -extensions server \