From patchwork Sun Oct 18 07:03:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5484 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:848c:b0:8dc:5c83:a4ec with SMTP id z12csp140570max; Sun, 18 Oct 2026 00:03:52 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBwLmSCKqLd8VXn6YUvsVK77FBFe1jbu7eQmudMoitwl6O5Ve+xZwKiHVOcIY6y88oBt4nWv9NH8TrM=@openvpn.net X-Received: by 2002:a05:6820:83c7:20b0:703:4abb:5628 with SMTP id 006d021491bc7-70357691e9dmr2001670eaf.64.1792307032341; Sun, 18 Oct 2026 00:03:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1792307032; cv=none; d=google.com; s=arc-20260327; b=P7Mc4WGfLzXkXsj5bhwhVPbDJDWjEF88BfrPU1QQ/VZr154kK0stMZKEDiLXl9bcs8 QpWUvTKmGawqkBzRh9Co0hjzynI/v5C48QIiWVfWsEaLfLTsv/sdxW4dxSx+k2U9/d/T LrEGi9MIUP2bNUZmc64sNNS5RDGerK1OtOjX+lcEPlBPqpe1043explNxYfCZYBHd6qp a7xp8KnpLlCrRbxlD68HlMXFy+WVUWMxMLj9/vjGUpxgxN7rDhy8OgpY62ER/BHc5Br+ CQ6yV/oYGBCnwZziOMciNeAlAGXYA8kvgN+bYYlt6hf48sH6LZwqX5mxs5P/O/OE4eXR o0WA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=W8N662BAjnSOsIgec4nNh5qnIv0Y2PkLxMn9EyZbjBo=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=kExUk5jGTyPqF+Rh/TsxWtGCHlbniNGEfn2WcHP9kq157U33Ja+2fpJq2JT1qKwSuO 1KbmRU4A4m3/21afULkLwBfwlvpPAbpLh1h864twhFXL3MKqCqcRhoVWIHo05fAAvJGA dktw6AVf9rffH+q8m7SyRgEls0jzMzN6UiCeYCGhfYO3Bp3l1SVsuzHiMuMTW5+GlgZy kk9+9V9fRXFVrr/tK16V+MqXXSBjgR7Xb3Ed/jhhdIy0MUSQzQhw+l3R7iaT47KKxvdn I+PNFd1OuEb3YSL4Zunn5EoArQ2TH9HC2Ia/HNf1x+ZkOfRUsvO0v01kCvJG38Wg2EZ2 f7qg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=S3Y7DFam; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=hNfJlenm; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=MLqZKStW; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-4a73b882431si9893270fac.329.2026.10.18.00.03.51 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sun, 18 Oct 2026 00:03:51 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=S3Y7DFam; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=hNfJlenm; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=MLqZKStW; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=W8N662BAjnSOsIgec4nNh5qnIv0Y2PkLxMn9EyZbjBo=; b=S3Y7DFamasFgXlxNFYiuLbWwRZ t5NCd8vcVwEoqvpnuQDPh8Iww2FKKMo1AJX6hL9DL9rCOuiYu/bOUy2j5H163m0dyaDXcK9lOHnp3 IjWVKkuELWAx5lehjFBkXxTmfJo7PLl8ufUNISTQ1hDTYBmWRwI5qex5xlr3c4ubO4V0=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1xIKvk-0007VK-NC; Sun, 18 Oct 2026 07:03:40 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1xIKva-0007V7-2K for openvpn-devel@lists.sourceforge.net; Sun, 18 Oct 2026 07:03:30 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=XdQAEXhLnZvjOklu4ePt0mi/Y5BWFl/IuNB7dL3R9pA=; b=hNfJlenmxiew1T9Z/6GLMTH+Gn diB1Jdf4vu2kNXqvaZJ/z5eaVjGnUA34SjcDxpUcoMVPeGt+/EntHHYJloiE0Co6xfCPV/uDOWGM6 HllLHUAk2H5J9NtiAvrjHaoXvCQdRcDHRMZMbaim4Y/I2fMiGFfZL2P2ITkOT8WvxHyk=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=XdQAEXhLnZvjOklu4ePt0mi/Y5BWFl/IuNB7dL3R9pA=; b=MLqZKStWMeREo3Zg95kZe9lYac 5iSL6zNuCsaFdnIRc8VwW9pRMNtHbTDutSucrLOVImVqPXT3ZUxkSx6A4K8FPW/LsuRW2Ef/XSs8W pPW93CRHMsSGNIEEfsSE57BCYGFChh/ukyN6/nA2lYpcp4bebmYz5SdtriXneEF8zCw0=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1xIKvY-0004Zt-6p for openvpn-devel@lists.sourceforge.net; Sun, 18 Oct 2026 07:03:30 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 69I73LHq015764 for ; Sun, 18 Oct 2026 09:03:21 +0200 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 69I73L6I015763 for openvpn-devel@lists.sourceforge.net; Sun, 18 Oct 2026 09:03:21 +0200 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Sun, 18 Oct 2026 09:03:15 +0200 Message-ID: <20261018070320.15749-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Steffan Karger Newer OpenSSL versions refuse to add authorityKeyIdentifier with issuer:always to a CSR, since there is no issuer certificate yet. The extensions are already applied when signing with 'openssl ca', so [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [193.149.48.129 listed in list.dnswl.org] 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xIKvY-0004Zt-6p Subject: [Openvpn-devel] [PATCH v1] gen-sample-keys.sh: Don't apply server extensions to CSRs X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1879370138714255053 X-GMAIL-MSGID: 1879370138714255053 From: Steffan Karger Newer OpenSSL versions refuse to add authorityKeyIdentifier with issuer:always to a CSR, since there is no issuer certificate yet. The extensions are already applied when signing with 'openssl ca', so drop them from the 'openssl req' calls. Change-Id: I3513563f199e1c5ac98219a527695e40540a9f73 Signed-off-by: Steffan Karger Acked-by: Razvan Cojocaru Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2009 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2009 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru diff --git a/sample/sample-keys/gen-sample-keys.sh b/sample/sample-keys/gen-sample-keys.sh index fa5f697..e5a11f5 100755 --- a/sample/sample-keys/gen-sample-keys.sh +++ b/sample/sample-keys/gen-sample-keys.sh @@ -31,7 +31,7 @@ -config openssl.cnf # Create server key and cert -openssl req -new -nodes -config openssl.cnf -extensions server \ +openssl req -new -nodes -config openssl.cnf \ -keyout sample-ca/server.key -out sample-ca/server.csr \ -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server/emailAddress=me@myhost.mydomain" openssl ca -batch -config openssl.cnf -extensions server \ @@ -66,7 +66,6 @@ openssl dsaparam -out sample-ca/dsaparams.pem 2048 openssl req -new -newkey dsa:sample-ca/dsaparams.pem -nodes -config openssl.cnf \ - -extensions server \ -keyout sample-ca/server-dsa.key -out sample-ca/server-dsa.csr \ -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server-DSA/emailAddress=me@myhost.mydomain" openssl ca -batch -config openssl.cnf -extensions server \ @@ -82,7 +81,6 @@ openssl ecparam -out sample-ca/secp256k1.pem -name secp256k1 openssl req -new -newkey ec:sample-ca/secp256k1.pem -nodes -config openssl.cnf \ - -extensions server \ -keyout sample-ca/server-ec.key -out sample-ca/server-ec.csr \ -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server-EC/emailAddress=me@myhost.mydomain" openssl ca -batch -config openssl.cnf -extensions server \