<html><head></head><body><div>Hello Jelle,</div><div><br></div><div>you simply confused the versions. For X.509 the latest version is 3, while PKCS#10 CSRs are stuck with v1.</div><div>For this plain old CSR format there is no later one. See also <a href="https://www.rfc-editor.org/rfc/rfc2986#section-4">https://www.rfc-editor.org/rfc/rfc2986#section-4</a>.</div><div><br></div><div>BTW, I wonder why you first produce a certificate, skipping the CSR (cert request) step, and then produce a CSR.</div><div>You don't need a CSR when all you need is a self-signed (end-entity or root CA) certificate.</div><div><br></div><div>Better stop using OpenSSL 1.1.x - its support will end in September, but switch to 3.0 (with long-term support).</div><div>For producing such a simple certificate, you don't need to rely on any OpenSSL config (*.cnf) file.</div><div>Better do not use RSA with just 1024 bits anymore, but 2048 bits.<br>And to be be precise with 10 years of validity, take leap years into account.<br>For the extensions, all you need is any subject alternative names.</div><div><br></div><div>For key usage, with RSA keys only digitalSignature and keyEncipherment makes sense,</div><div>while for EC keys only <span style="font-size: 14.666667px;">digitalSignature and keyAgreement makes sense,</span><br>but this can simply be left out, meaning that any key usage is allowed (which is safe for more situations).</div><div><br></div><div>So I suggest this:</div><div><br></div><pre>openssl req -x509 -new -newkey rsa:2048 -nodes -keyout key.pem \</pre><pre> -out cert.pem -days 3653 -subj '/CN=test.example.lan' \</pre><pre> -addext 'subjectAltName = DNS:test.example.lan' \</pre><pre> -addext 'keyUsage = digitalSignature, keyEncipherment'</pre><div><br></div><div>If you already have a key or want to produce it separately, use can use</div><div><br></div><pre>openssl genrsa -out key.pem 2048</pre><pre>openssl ecparam -genkey -name prime256v1 -out key.pem # alternative for EC key, faster and smaller</pre><pre><br></pre><pre>openssl x509 -new -key key.pem -out cert.pem -days 3653 -subj '/CN=test.example.lan' \</pre><pre> -extfile <(echo -n "subjectAltName = DNS:test.example.lan \n keyUsage = digitalSignature, keyEncipherment")</pre><div><br></div><div>where as mentioned you can safely drop the keyUsage part.</div><div><br></div><div>Best,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>David</div><div><br></div><div><br></div><div><span></span></div><div>On Wed, 2023-04-26 at 12:11 +0200, Jelle de Jong wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>Hello everybody,<br></div><div><br></div><div>I am trying to generate a CSR with X509v3 from a working X509v3 cert but <br></div><div>the output generates a version 1 CSR without X509v3.<br></div><div><br></div><div>These are the steps to reproduce:<br></div><div><br></div><div>openssl req -utf8 -x509 -nodes -new -keyout key.pem -out cert.pem -days <br></div><div>3650 -subj '/CN=test.example.lan' -extensions v3_req -addext <br></div><div>'subjectAltName = DNS:test.example.lan'<br></div><div><br></div><div>openssl x509 -x509toreq -in cert.pem -signkey key.pem -out csr.pem <br></div><div>-extensions v3_req -ext <br></div><div>subjectAltName,keyUsage,basicConstraints,extendedKeyUsage,certificatePolicies<br></div><div><br></div><div>openssl req -in csr.pem -noout -verify<br></div><div><br></div><div>openssl req -in csr.pem -out csr.req<br></div><div><br></div><div># show X509v3 Subject Alternative Name:<br></div><div>openssl x509 -in cert.pem -text -noout<br></div><div><br></div><div># does not show X509v3 Subject Alternative Name:<br></div><div>openssl req -in csr.req -text -noout<br></div><div><br></div><div>Tried with the bollow two versions<br></div><div><br></div><div>$ openssl version<br></div><div>OpenSSL 1.1.1n 15 Mar 2022<br></div><div><br></div><div># openssl version<br></div><div>OpenSSL 1.1.1k FIPS 25 Mar 2021<br></div><div><br></div><div>Can someone, do I need a diffrent openssl x509 -x509toreq -extensions ...<br></div><div><br></div><div>Thank you in advance,<br></div><div><br></div><div>Kind regards,<br></div><div><br></div><div>Jelle de Jong<br></div><div><br></div></blockquote></body></html>