slawek/simple-ca
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update: add keyUsage extension to CA and certificate generation
All checks were successful
/ test (push) Successful in 11s
Details

Browse Source
This commit is contained in:
Sławek Koszewski
2026-04-08 22:51:49 +02:00
parent 8bb0c62486
commit ba11980e88
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
simple-ca.sh
View File

@@ -123,7 +123,8 @@ function make_ca() {
-noenc \ -noenc \
-subj "/CN=${CA_NAME}" \ -subj "/CN=${CA_NAME}" \
-text \ -text \
-addext "basicConstraints=critical,CA:TRUE,pathlen:1"; then -addext "basicConstraints=critical,CA:TRUE,pathlen:1" \
-addext "keyUsage=critical,keyCertSign,cRLSign"; then
echo "ERROR: Failed to generate CA certificate and key." >&2 echo "ERROR: Failed to generate CA certificate and key." >&2
return 1 return 1
fi fi
@@ -146,6 +147,7 @@ function make_ca() {
-noenc \ -noenc \
-subj "/CN=${CA_NAME}" \ -subj "/CN=${CA_NAME}" \
-addext "basicConstraints=critical,CA:TRUE,pathlen:0" \ -addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
-addext "keyUsage=critical,keyCertSign,cRLSign" \
${AIA_BASE_URL:+-addext "authorityInfoAccess=caIssuers;URI:${AIA_BASE_URL}/ca_cert.crt"} \ ${AIA_BASE_URL:+-addext "authorityInfoAccess=caIssuers;URI:${AIA_BASE_URL}/ca_cert.crt"} \
| openssl x509 \ | openssl x509 \
-req \ -req \
@@ -301,7 +303,7 @@ function make_cert() {
-noenc \ -noenc \
-subj "/CN=${CERT_SUBJECT_NAME}" \ -subj "/CN=${CERT_SUBJECT_NAME}" \
-addext "basicConstraints=critical,CA:FALSE" \ -addext "basicConstraints=critical,CA:FALSE" \
-addext "keyUsage=digitalSignature,keyEncipherment" \ -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
-addext "extendedKeyUsage=serverAuth,clientAuth" \ -addext "extendedKeyUsage=serverAuth,clientAuth" \
-addext "$SANS_EXT" \ -addext "$SANS_EXT" \
${AIA_URL:+-addext "authorityInfoAccess=caIssuers;URI:${AIA_URL}"} \ ${AIA_URL:+-addext "authorityInfoAccess=caIssuers;URI:${AIA_URL}"} \