☰

使用命令行工具创建带有 v3 扩展的 X509 证书

tag-icon • tag-icon openssl certificates
使用命令行工具创建带有 v3 扩展的 X509 证书

我正在使用以下名为 root.conf 的配置文件：

[req]
default_bits            = 2048
default_md              = sha256
distinguished_name      = req_dn
prompt                  = no
encrypt_key             = no

[req_dn]
CN                      = 07dda2b49637f71b6cebe87a6954e159313b4372

[x509v3_extensions]
basicConstraints        = critical,CA:true
subjectKeyIdentifier    = hash
keyUsage                = critical,keyCertSign,cRLSign
subjectInfoAccess       = @sia
certificatePolicies     = critical,1.3.6.1.5.5.7.14.2
sbgp-autonomousSysNum   = critical,@rfc3779_asns
sbgp-ipAddrBlock        = critical,@rfc3997_addrs

[sia]
1.3.6.1.5.5.7.48.5;URI  = rsync://example.org/rpki/root/
1.3.6.1.5.5.7.48.10;URI = rsync://example.org/rpki/root/root.mft

[rfc3779_asns]
AS.0 = 64496-64511
AS.1 = 65536-65551

[rfc3997_addrs]
IPv4.0 = 192.0.2.0/24
IPv4.1 = 198.51.100.0/24
IPv4.2 = 203.0.113.0/24
IPv6.0 = 2001:0DB8::/32

我正在使用此命令来创建证书：

#!/bin/sh -    
# Generate the root key if it doesn't already exist.
test -f root.key ||
openssl genrsa -out root.key 2048

# Generate the root certificate.
openssl req                     \
-new                    \
-x509                   \
-config root.conf       \
-key    root.key        \
-out    root.cer        \
-outform    DER         \
-days       1825        \
-set_serial 1           \
-extensions x509v3_extensions

但如果我使用上面的配置文件运行它，我会收到以下错误：

Error Loading extension section x509v3_extensions
139978043373216:error:22097081:X509 V3 routines:DO_EXT_NCONF:unknown     extension:v3_conf.c:129:
139978043373216:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension:v3_conf.c:93:name=sbgp-autonomousSysNum, value=@rfc3779_asns

上面这组代码直接取自http://rpki.net/wiki/doc/RPKI/CA/Configuration/CreatingRoot

答案1

语法应该是：

openssl x509 -new

前面没有破折号x509

相关内容