Hot answers tagged certificate
I believe, according to the docs, you only need to do ./sign-req keys/linuxclient2 or similar - it wants to take care of the "file extensions" on its own. https://openvpn.net/index.php/open-source/documentation/miscellaneous/77-rsa-key-management.html
Openssl smime, in verify mode, passes the -purpose option through to an invocation of openssl verify. In consequence, you should be able to add -purpose sslserver and have it validate. I tested this on version 1.0.2d and it worked well.
That is unfortunately correct. Running puppet cert clean $certname is not enough to lock out a still active node. You must restart the puppet master afterwards to actually use the new CRL. See: https://docs.puppetlabs.com/references/latest/man/cert.html#ACTIONS under revoke but that applies to clean as well.
Short answer: yes. The makers of OpenSSL aren't stupid, and they didn't design the tool to produce insecure output by default. After that, it's up to the user not to make mistakes that make the system insecure, for instance by leaking the private key. A RSA 2048-bit key (or 4096-bit, if you're paranoid) will provide security for all your uses. Attacks on ...
Only top voted, non community-wiki answers of a minimum length are eligible