I'm putting certificates into a repository that will not allow a successive certificate with more limited usage than the previous one. I need an initial dummy cert/key/chain to bootstrap the process whose usages are not more open than Let's Encrypt host certs which allow serverAuth and clientAuth. All I need is a dummy host cert that has these usages or less. However I have been unable to produce this given many iterations of commands, after reading many articles and SO posts yesterday and today.
Here is what I'm working with:
#!/bin/bash -e rm dummy* days=100 openssl genrsa -out dummy-root.key 2048 openssl req -new -x509 -days $days -subj '/C=US/ST=TX/O=foo/OU=bar/CN=dummy-root.com' -key dummy-root.key -out dummy-root.crt openssl genrsa -out dummy-class2.key 2048 openssl req -new -subj '/C=US/ST=TX/O=foo/OU=bar/CN=dummy-class2.com' -key dummy-class2.key -out dummy-class2.csr openssl x509 -req -days $days -in dummy-class2.csr -CA dummy-root.crt -CAkey dummy-root.key -CAcreateserial -out dummy-class2.crt openssl genrsa -out dummy-host.key 2048 openssl req -new -config gen.host.cfg -key dummy-host.key -out dummy-host.csr -extensions my_server_exts openssl x509 -req -days $days -in dummy-host.csr -CA dummy-class2.crt -CAkey dummy-class2.key -set_serial 1 -out dummy-host.crt -sha256 -ext subjAltName rm *.srl *.csr cat dummy-host.crt dummy-class2.crt dummy-root.crt > dummy-chain.crt # this always fails? # openssl verify --CAfile dummy-root.crt -untrusted dummy-class2.crt dummy-host.crt openssl x509 -noout -ext extendedKeyUsage < dummy-host.crt
And for the config file needed for the extensions (referred to above):
[ req ] prompt = no default_bits = 2048 default_md = sha256 distinguished_name = my_dn req_extensions = my_server_exts [ my_dn ] # The bare minimum is probably a commonName commonName = dummy-host2.com countryName = US organizationName = foo organizationalUnitName = bar [ my_server_exts ] basicConstraints = critical,CA:false keyUsage = keyEncipherment # extendedKeyUsage = serverAuth extendedKeyUsage = 126.96.36.199.188.8.131.52.1
The last line of gen.sh tries to read the extensions and always says "No extensions in certificate", which when sent to the certificate repository interprets as having "ANY" usage, and then refuses to reduce the usage when updating with a Lets Encrypt cert.
Why is my specified EKU not making it to the cert? Or how else can I create a cert that has a limited usage?