Menu
I know how to sign a CSR using openssl, but the result certificate is an x509 v1, and not v3.
I'm using the following commands:
x509 -req -days 365 -in myCSR.csr -CA myCA.crt -CAkey myCA.key -CAcreateserial -out userCertificate.crt I've searched but have not been able to find a solution. Is there another way to do this programmatically?
682
Go to Start > Administrative Tools > Internet Information Servicess (IIS) Manager. Select the server name from the left-side panel. In the center panel, double-click Server Certificates. In the Actions menu from the right-side, click Create Certificate Request.
The main steps for configuring and using X.509 user-signed certificates for single sign-on authentication are: Create a local certificate authority (CA). Create a user certificate with a private key, a certificate signing request (CSR), and a public key. Generate a PFX user certificate and upload it to Chrome.
Create a certificate signing request (CSR) for the key. You don't need to enter a challenge password or an optional company name. You must, however, enter the device ID in the common name field. You can also enter your own values for the other parameters such as Country Name, Organization Name, and so on.
First, generate a private key and the certificate signing request (CSR) in the rootca directory. Next, create a self-signed CA certificate. Self-signing is suitable for testing purposes. Specify the ca_ext configuration file extensions on the command line.
To generate a client certificate, you must first generate a private key. The following command shows how to use OpenSSL to create a private key. Create the key in the subca directory. Create a certificate signing request (CSR) for the key. You don't need to enter a challenge password or an optional company name.
You need to specify an extensions file.
For example:
openssl x509 -days 365 -in myCSR.csr -extfile v3.ext -CA myCA.crt -CAkey myCA.key -CAcreateserial -out userCertificate.crt The extensions file (v3.ext) can look like this:
authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment The answer of gtrig works if you have -req as well. It didn't work without that for me.
So the command is:
openssl x509 -req -in myCSR.csr -extfile v3.ext -CA myCA.crt -CAkey myCA.key -CAcreateserial -out userCertificate.crt -days 365 (had to give as a new answer as I don't have enough rep. to comment).
22
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
