Howto create a certificate using openssl including a CRL distribution point?

Question

I\'m having problems using openssl to create a x509 certificate containing a crl distribution point for testing.

I\'ve checked the documentation and found the configurat

Answer 1

openssl x509 does not read the extensions configuration you've specified above in your config file.

You can get the crlDistributionPoints into your certificate in (at least) these two ways:

1. Use openssl ca rather than x509 to sign the request. Pass -config as needed if your config is not in a default location. Most of your provided command can be used if you omit the options starting with -CA

   openssl ca -in $NAME.csr -out certs/$NAME.pem -days 3650

2. Use the command as you've provided in your question, but first create a file containing your v3 extensions (ie mycrl.cnf); add the option -extfile mycrl.cnf to your call to openssl x509

   openssl x509 -req -in $NAME.csr -out certs/$NAME.pem -days 3650 \
     -CAcreateserial -CA cacert.pem -CAkey private/cakey.pem \
     -CAserial serial -extfile mycrl.cnf`
   

   Where mycrl.cnf contains the following:

   crlDistributionPoints=URI:http://example.com/crl.pem

openssl ca is probably the command better suited to what you want to do, since most examples you will find rely on that command utilizing various settings in openssl.cnf for v3 extensions.

An aside: it is inadvisable to use MD5 message digest in certificates.

Previously SHA1 was the suggested alternative to MD5, however that too is now becoming deprecated. You can specify the message digest used in requests and signing operations, and you can list the supported message digests with openssl list-message-digest-commands.

As an example, you can use SHA256 when signing a request with the -md sha256 option to openssl ca ( or setting default_md=sha256 in your [CA_default] config section).