<html><head></head><body><div>On Wed, 2023-04-26 at 17:38 +0200, Jelle de Jong wrote:</div><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>I do not see the CSR back in your suggestion.</div></blockquote><div><br></div><div>Yes, because I thought you do not need it because you produce a certificate before.<br>And where needed, for simplicity and consistency better derive it from the certificate rather than creating it from scratch.</div><div><br></div><div>Concerning the problem you mentioned that <span style="font-size: 14.666667px;"><font face="Courier New, Courier, monospace">openssl x509 -x509toreq</font> (by default) does not copy</span> X509v3 extensions<br>(BTW, PKCS#10 version 1 does support X.509 v3 extensions), I <a href="https://github.com/openssl/openssl/pull/13711">added support for this in OpenSSL 3.0</a>, to use as follows:</div><div><br></div><pre>openssl x509 -x509toreq -in cert.pem -signkey key.pem -copy_extensions copy</pre><pre><br></pre><div>Even more straightforward would be to produce first a CSR, like this:</div><div><br></div><pre>openssl req -new -key key.pem -out csr.pem -subj '/CN=test.example.lan' \</pre><pre> -addext 'subjectAltName = DNS:test.example.lan' \</pre><pre> -addext 'keyUsage = digitalSignature, keyEncipherment'</pre><div><br></div><div>and then derive a certificate, using the extension copy feature I <a href="https://github.com/openssl/openssl/pull/13658">added to this app as well in OpenSSL 3.0</a> as follows: </div><div><br></div><pre>openssl req -x509 -key key.pem -in csr.pem -copy_extensions copy </pre><pre><br></pre><div><br></div><div>Yet of course both approaches do not work for you as long as you are stuck with OpenSSL 1.x.</div><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>Sadly only Debian Testing is shipping openssl 3.0.8-1 and there is no<span class="Apple-converted-space"> </span><br></div><div>backports package and my other systems also did not ship with version 3<span class="Apple-converted-space"> </span><br></div><div>for testing.<span class="Apple-converted-space"> </span><a href="https://packages.debian.org/bullseye/openssl" style="color: rgb(46, 52, 54);">https://packages.debian.org/bullseye/openssl</a></div></blockquote><div><br></div><div style="font-size: 14.666667px;">I have the same issue with Debian 11 <span style="font-size: 14.666667px;">(bullseye).</span></div><div>Yet one can easily compile any OpenSSL version 3.x also on any recent version of Debian.<br>There are nice tutorials how to do this, see for instance <a href="https://orcacore.com/install-openssl-3-debian-11/">here</a>.</div><div><br></div><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>What I am doing is to create a working but self-signed certificate first </div><div>and then replacing it later with a certificate signed by the<span class="Apple-converted-space"> </span><br></div><div>organisation (which can take multiple weeks at this customer).<br></div><div><br></div><div>That is why I want to generate a CSR from a working certificate that I<span class="Apple-converted-space"> </span>generated.</div></blockquote><div><br></div><div>I understand.</div><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>-days 3653</div></blockquote><div><br></div><div>PKCS#10 CSRs (as opposed to <a href="https://datatracker.ietf.org/doc/html/rfc4211">CRMF</a> CSRs) do not support a validity period - <br>this needs to be defined and set by the certificate issuer (usually, a CA).</div><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>-newkey rsa:2048<br></div><div><br></div><div>Is there a way without having to use the -extfile configuration file?<br></div></blockquote><div><br></div><div>As I see in your below email, you meanwhile found (with the hints given before) how to do this.</div><div><br></div><div>Kind regards,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>David</div><div><br></div><div><br></div><div>On Wed, 2023-04-26 at 18:45 +0200, Jelle de Jong wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>On 4/26/23 12:24, Dirk-Willem van Gulik wrote:<br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>On 26 Apr 2023, at 12:11, Jelle de Jong <<a href="mailto:jelledejong@powercraft.nl">jelledejong@powercraft.nl</a>> wrote:<br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>I am trying to generate a CSR with X509v3 from a working X509v3 cert but the output generates a version 1 CSR without X509v3.<br></div><div><br></div><div>These are the steps to reproduce:<br></div><div><br></div><div>openssl req -utf8 -x509 -nodes -new -keyout key.pem -out cert.pem -days 3650 -subj '/CN=test.example.lan' -extensions v3_req -addext 'subjectAltName = DNS:test.example.lan'<br></div><div><br></div><div>openssl x509 -x509toreq -in cert.pem -signkey key.pem -out csr.pem -extensions v3_req -ext subjectAltName,keyUsage,basicConstraints,extendedKeyUsage,certificatePolicies<br></div><div><br></div><div>openssl req -in csr.pem -noout -verify<br></div><div><br></div><div>openssl req -in csr.pem -out csr.req<br></div><div><br></div><div># show X509v3 Subject Alternative Name:<br></div><div>openssl x509 -in cert.pem -text -noout<br></div><div><br></div><div># does not show X509v3 Subject Alternative Name:<br></div><div>openssl req -in csr.req -text -noout<br></div><div><br></div><div>Tried with the bollow two versions<br></div><div><br></div><div>$ openssl version<br></div><div>OpenSSL 1.1.1n 15 Mar 2022<br></div><div><br></div><div># openssl version<br></div><div>OpenSSL 1.1.1k FIPS 25 Mar 2021<br></div><div><br></div><div>Can someone, do I need a diffrent openssl x509 -x509toreq -extensions …<br></div></blockquote><div><br></div><div><br></div><div>I’d expect your default openssl.cnf or something to be empty or incomplete.<br></div><div><br></div><div>This should work:<br></div><div><br></div><div> cat <<EOM > ext.cnf<br></div><div> authorityKeyIdentifier=keyid,issuer<br></div><div> basicConstraints=CA:FALSE<br></div><div> keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment<br></div><div> EOM<br></div><div><br></div><div> openssl x509 -x509toreq -in cert.pem -signkey key.pem -out csr.pem -extfile ./ext.cnf<br></div><div> openssl req -in csr.req -text -noout<br></div><div><br></div><div>Dw.<br></div><div><br></div><div><br></div><div>% cat ext.cnf<br></div><div>authorityKeyIdentifier=keyid,issuer<br></div><div>basicConstraints=CA:FALSE<br></div><div>keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment<br></div><div><br></div><div>% openssl x509 -x509toreq -in cert.pem -signkey key.pem -extfile ./ext.cnf | openssl req -text -noout<br></div><div>Certificate Request:<br></div><div> Data:<br></div><div> Version: 1 (0x0)<br></div><div> Subject: CN = test.example.lan<br></div><div> Subject Public Key Info:<br></div><div> Public Key Algorithm: rsaEncryption<br></div><div> Public-Key: (2048 bit)<br></div><div> Modulus:<br></div><div>...</div><div> Exponent: 65537 (0x10001)<br></div><div> Attributes:<br></div><div> Requested Extensions:<br></div><div> X509v3 Authority Key Identifier: DirName:/CN=test.example.lan<br></div><div> serial:39:87:74:CF:10:D6:65:50:B4:AF:45:3A:1D:87:98:7A:D3:B5:16:EF<br></div><div> X509v3 Basic Constraints: CA:FALSE<br></div><div> X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment<br></div><div> Signature Algorithm: sha256WithRSAEncryption<br></div><div> Signature Value:<br></div><div> ac:8a:5a:14:61:2f:59:21:b3:60:02:80:a5:c5:62:19:33:22:<br></div><div>...</div><div><br></div></blockquote><div><br></div><div>Thank you Dirk-Willem for replying!<br></div><div><br></div><div>I found a workaround for -x509toreq I tried the above and it did not <br></div><div>generate the X509v3 extentions! Even after I catched the csr.pem vs <br></div><div>csr.req mistake in the example command.<br></div><div><br></div><div>If someone can get the x509toreq output the X509v3 as expected then I <br></div><div>would love to see this.<br></div><div><br></div><div>Sadly only Debian Testing is shipping openssl 3.0.8-1 and there is no <br></div><div>backports package and my other systems also did not ship with version 3 <br></div><div>for testing. <a href="https://packages.debian.org/bullseye/openssl">https://packages.debian.org/bullseye/openssl</a><br></div><div><br></div><div>I needed to be able to reuse the same private key so I used both yours <br></div><div>and David example and came up with this:<br></div><div><br></div><div>openssl genrsa -out key.pem 4096<br></div><div><br></div><div>openssl req -utf8 -x509 -nodes -new -key key.pem -out cert.pem -days <br></div><div>3653 -subj '/CN=test.example.lan' -addext 'subjectAltName = <br></div><div>DNS:test.example.lan' -addext 'keyUsage = digitalSignature, keyEncipherment'<br></div><div><br></div><div>openssl req -utf8 -nodes -new -key key.pem -out csr.pem -subj <br></div><div>'/CN=test.example.lan' -addext 'subjectAltName = DNS:test.example.lan' <br></div><div>-addext 'keyUsage = digitalSignature, keyEncipherment'<br></div><div><br></div><div>openssl req -in csr.pem -noout -verify<br></div><div>verify OK<br></div><div><br></div><div>openssl req -in csr.pem -text -noout<br></div><div>Certificate Request:<br></div><div> Data:<br></div><div> Version: 1 (0x0)<br></div><div> Subject: CN = test.example.lan<br></div><div> Subject Public Key Info:<br></div><div> Public Key Algorithm: rsaEncryption<br></div><div> RSA Public-Key: (4096 bit)<br></div><div> Modulus:<br></div><div>...</div><div> Exponent: 65537 (0x10001)<br></div><div> Attributes:<br></div><div> Requested Extensions:<br></div><div> X509v3 Subject Alternative Name:<br></div><div> DNS:test.example.lan<br></div><div> X509v3 Key Usage:<br></div><div> Digital Signature, Key Encipherment<br></div><div> Signature Algorithm: sha256WithRSAEncryption<br></div><div>...</div><div><br></div></blockquote></body></html>