<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EstiloCorreo18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=ES link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='mso-fareast-language:EN-US'>Hi,<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-US'>Uncomment line 54<o:p></o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='mso-fareast-language:EN-US'>crl_extensions = crl_ext<o:p></o:p></span></a></p><p class=MsoNormal><span style='mso-bookmark:_MailEndCompose'><span style='mso-fareast-language:EN-US'><o:p> </o:p></span></span></p><p class=MsoNormal><span style='mso-bookmark:_MailEndCompose'><span style='mso-fareast-language:EN-US'>BR <o:p></o:p></span></span></p><p class=MsoNormal><span style='mso-bookmark:_MailEndCompose'><span style='mso-fareast-language:EN-US'>Juan Ángel<o:p></o:p></span></span></p><p class=MsoNormal><span style='mso-bookmark:_MailEndCompose'><span style='mso-fareast-language:EN-US'><o:p> </o:p></span></span></p><span style='mso-bookmark:_MailEndCompose'></span><p class=MsoNormal><b>De:</b> openssl-users [mailto:openssl-users-bounces@openssl.org] <b>En nombre de </b>Ivan Rubinson<br><b>Enviado el:</b> jueves, 1 de junio de 2017 12:15<br><b>Para:</b> openssl-users@openssl.org<br><b>Asunto:</b> [openssl-users] Making a CRL with an authority key identifier<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div><div><div><div><div><div><div><div><div><p class=MsoNormal style='margin-bottom:12.0pt'>Hello,<o:p></o:p></p></div><p class=MsoNormal>My name is Ivan, and I'm trying to get OpenSSL to make a CRL with an authority key identifier.<o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'>(a third party API expects it from the CRL)<o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'>I make my own CA, use it to sign a certificate, and then generate the CRL. This is the configuration file: <a href="https://pastebin.com/yL4UBtGW">https://pastebin.com/yL4UBtGW</a> (it's basically the example configuration file with a few changes).<o:p></o:p></p></div><p class=MsoNormal>Here are the commands I run:<o:p></o:p></p></div><div><p class=MsoNormal>Making the CA:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><p class=MsoNormal>openssl req -new -x509 -days 3650 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -config req.cnf<o:p></o:p></p></blockquote></div><div><p class=MsoNormal>Making the certificate:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><p class=MsoNormal>openssl req -new -nodes -out pdf-req.pem -keyout private/pdf-pkey.pem -config req.cnf<br>openssl ca -config req.cnf -out pdf-cert.pem -infiles pdf-req.pem<o:p></o:p></p></blockquote></div><div><p class=MsoNormal>Making the CRL:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><p class=MsoNormal>openssl ca -config req.cnf -gencrl -out crl.pem<o:p></o:p></p></blockquote></div><div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'>I'm using OpenSSL-Win64 0.9.8g<o:p></o:p></p></div><p class=MsoNormal>Even though on line 251 I ask OpenSSL to have an authority key identifier, the generated CRL doesn't have it. I've searched on google and tried multiple things (like uncommenting issuerAltName, or giving it different options) and the CRL still doesn't have it.<o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'>At this point I'm stumped, and I'd like to ask you nice people for help.<br><br><o:p></o:p></p></div><p class=MsoNormal>Thank you in advance,<o:p></o:p></p></div><p class=MsoNormal>Ivan Rubinson<o:p></o:p></p></div><div id=DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2><p class=MsoNormal><o:p> </o:p></p><table class=MsoNormalTable border=1 cellspacing=3 cellpadding=0 style='border:none;border-top:solid #D3D4DE 1.0pt'><tr><td width=55 style='width:41.25pt;border:none;padding:9.75pt .75pt .75pt .75pt'><p class=MsoNormal><a href="https://www.avast.com/en-us/lp-safe-emailing-3108-b?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail&utm_term=oa-3108-b" target="_blank"><span style='text-decoration:none'><img border=0 width=46 height=29 style='width:.4833in;height:.3in' id="_x0000_i1025" src="https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif"></span></a><o:p></o:p></p></td><td width=470 style='width:352.5pt;border:none;padding:9.0pt .75pt .75pt .75pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt;font-family:"Arial",sans-serif;color:#41424E'>Virus-free. <a href="https://www.avast.com/en-us/lp-safe-emailing-3108-b?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail&utm_term=oa-3108-b" target="_blank"><span style='color:#4453EA'>www.avast.com</span></a> <o:p></o:p></span></p></td></tr></table><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>