diff mbox series

[Openvpn-devel,v1] gen-sample-keys.sh: use a random serial

Message ID 20261018130834.11953-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] gen-sample-keys.sh: use a random serial |

Commit Message

Gert Doering Oct. 18, 2026, 1:08 p.m. UTC 
  From: Steffan Karger <steffan@karger.me>

Instead of forcing openssl to create consecutive serial numbers, let it
generate random serials. Although not really relevant for the sample keys,
that is the best practice.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2010
Change-Id: Ic36123c5a4a2b2295ffdf47174e2aceb9d17d668
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2010
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <razvanc@mailbox.org>
diff mbox series

Patch

diff --git a/sample/sample-keys/gen-sample-keys.sh b/sample/sample-keys/gen-sample-keys.sh
index e5a11f5..e914fd2 100755
--- a/sample/sample-keys/gen-sample-keys.sh
+++ b/sample/sample-keys/gen-sample-keys.sh
@@ -22,7 +22,6 @@ 
 mkdir -p sample-ca
 rm -f sample-ca/index.txt
 touch sample-ca/index.txt
-echo "01" > sample-ca/serial
 
 # Generate CA key and cert
 openssl req -new -newkey rsa:4096 -days 3650 -nodes -x509 \
diff --git a/sample/sample-keys/openssl.cnf b/sample/sample-keys/openssl.cnf
index 02bf8ac..dcaebb7 100644
--- a/sample/sample-keys/openssl.cnf
+++ b/sample/sample-keys/openssl.cnf
@@ -14,7 +14,7 @@ 
 new_certs_dir	= $dir			# default place for new certs.
 
 certificate	= $dir/ca.crt	 	# The CA certificate
-serial		= $dir/serial 		# The current serial number
+rand_serial	= yes			# Use random serial numbers
 crl		= $dir/crl.pem 		# The current CRL
 private_key	= $dir/ca.key		# The private key
 RANDFILE	= $dir/.rand		# private random number file