<html><head></head><body><div>P.S. I forgot to mention some parameters in the example for getting a self-signed cert form a CSR - it should have read</div><div><br></div><pre>openssl req -x509 -key key.pem -in csr.pem -days 3653 -copy_extensions copy -out cert.pem</pre><div><br></div><div>or equivalently</div><div><br></div><pre>openssl x509 -req -key key.pem -in csr.pem -days 3653 -copy_extensions copy<span style="font-size: 14.666667px;"> </span><span style="font-size: 14.666667px;">-out cert.pem</span></pre><pre><br></pre><div>Another advantage of using the OpenSSL 3.0+ apps is that they automatically add any needed/recommended <br>subject key identifier (SKID) and authority key identifier (AKID) extensions (while they are not needed for self-signed end-entity certs),<br>without the need to use extension configuration files or <span style="font-size: 14.666667px;">CLI parameters such as<font face="Courier New, Courier, monospace"> </font></span><font face="Courier New, Courier, monospace">-addext 'authorityKeyIdentifier = keyid:always'</font></div><div><span></span></div><div><br></div><div>On Wed, 2023-04-26 at 21:07 +0200, David von Oheimb wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>On Wed, 2023-04-26 at 17:38 +0200, Jelle de Jong wrote:</div><div><br></div><div>I do not see the CSR back in your suggestion.</div><div><br></div><div>Yes, because I thought you do not need it because you produce a certificate before.<br>And where needed, for simplicity and consistency better derive it from the certificate rather than creating it from scratch.</div><div><br></div><div>Concerning the problem you mentioned that <span style="font-size: 14.666667px;"><font face="Courier New, Courier, monospace">openssl x509 -x509toreq</font> (by default) does not copy</span> X509v3 extensions<br>(BTW, PKCS#10 version 1 does support X.509 v3 extensions), I <a href="https://github.com/openssl/openssl/pull/13711">added support for this in OpenSSL 3.0</a>, to use as follows:</div><div><br></div><pre>openssl x509 -x509toreq -in cert.pem -signkey key.pem -copy_extensions copy</pre><pre><br></pre><div>Even more straightforward would be to produce first a CSR, like this:</div><div><br></div><pre>openssl req -new -key key.pem -out csr.pem -subj '/CN=test.example.lan' \</pre><pre> -addext 'subjectAltName = DNS:test.example.lan' \</pre><pre> -addext 'keyUsage = digitalSignature, keyEncipherment'</pre><div><br></div><div>and then derive a certificate, using the extension copy feature I <a href="https://github.com/openssl/openssl/pull/13658">added to this app as well in OpenSSL 3.0</a> as follows: </div><div><br></div><pre>openssl req -x509 -key key.pem -in csr.pem -copy_extensions copy </pre><pre><br></pre><div><br></div><div>Yet of course both approaches do not work for you as long as you are stuck with OpenSSL 1.x.</div><div><br></div><div>Sadly only Debian Testing is shipping openssl 3.0.8-1 and there is no<span class="Apple-converted-space"> </span><br></div><div>backports package and my other systems also did not ship with version 3<span class="Apple-converted-space"> </span><br></div><div>for testing.<span class="Apple-converted-space"> </span><a href="https://packages.debian.org/bullseye/openssl" style="color: rgb(46, 52, 54);">https://packages.debian.org/bullseye/openssl</a></div><div><br></div><div style="font-size: 14.666667px;">I have the same issue with Debian 11 <span style="font-size: 14.666667px;">(bullseye).</span></div><div>Yet one can easily compile any OpenSSL version 3.x also on any recent version of Debian.<br>There are nice tutorials how to do this, see for instance <a href="https://orcacore.com/install-openssl-3-debian-11/">here</a>.</div><div><br></div><div><br></div><div>What I am doing is to create a working but self-signed certificate first </div><div>and then replacing it later with a certificate signed by the<span class="Apple-converted-space"> </span><br></div><div>organisation (which can take multiple weeks at this customer).<br></div><div><br></div><div>That is why I want to generate a CSR from a working certificate that I<span class="Apple-converted-space"> </span>generated.</div><div><br></div><div>I understand.</div><div><br></div><div>-days 3653</div><div><br></div><div>PKCS#10 CSRs (as opposed to <a href="https://datatracker.ietf.org/doc/html/rfc4211">CRMF</a> CSRs) do not support a validity period - <br>this needs to be defined and set by the certificate issuer (usually, a CA).</div><div><br></div><div>-newkey rsa:2048<br></div><div><br></div><div>Is there a way without having to use the -extfile configuration file?<br></div><div><br></div><div>As I see in your below email, you meanwhile found (with the hints given before) how to do this.</div><div><br></div><div>Kind regards,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>David</div><div><br></div><div><br></div></blockquote></body></html>