<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 30/06/2015 18:32, Ben Humpert wrote:<br>
</div>
<blockquote
cite="mid:CAGbjqfFKhFsbSP1ZC8SCwHgGvL1bCoKN7Km2pGHEmjTPJTNCNg@mail.gmail.com"
type="cite">
<pre wrap="">2015-06-24 1:35 GMT+02:00 Jakob Bohm <a class="moz-txt-link-rfc2396E" href="mailto:jb-openssl@wisemo.com"><jb-openssl@wisemo.com></a>:
</pre>
<blockquote type="cite">
<pre wrap="">On 19/06/2015 16:24, Ben Humpert wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
When the CSR contains an email address and the email_in_dn setting in
the config file is set to "no" the email address is actually present
in the issuer DN but not in the subject DN. This causes errors when
verifying certificate chains since the subject hash is used to
identify a cert but the issuer hash is different.
</pre>
</blockquote>
<pre wrap="">
Are you sure, I have not seen this behavior in current
versions when making self-signed certificates, could
you provide step by step reproduction procedures to
cause this misbehavior?
</pre>
</blockquote>
<pre wrap="">
...
openssl req -new -out /etc/ssl/ca/RootCA.csr
openssl ca -selfsign -in /etc/ssl/ca/RootCA.csr -out
/etc/ssl/ca/RootCA.crt -notext -startdate 150101000000Z -enddate
191231235959Z
</pre>
</blockquote>
<tt>Ah, I didn't even know about that "ca -selfsign" option, <br>
I generally create my root certs using the req or x509 <br>
command directly.</tt><tt><br>
</tt><tt><br>
</tt><tt>I wonder if the ca -selfsign variant takes its <br>
email_in_DN option from a different section than regular <br>
cert signing.</tt><tt><br>
</tt><tt><br>
</tt><tt>Besides, putting an e-mail attribute in a CSR for a CA <br>
seems unusual.</tt><tt><br>
<br>
</tt>
<pre class="moz-signature" cols="72">Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. <a class="moz-txt-link-freetext" href="http://www.wisemo.com">http://www.wisemo.com</a>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded </pre>
</body>
</html>