I did a bunch of searching, but I couldn't find an answer. I'm posting this here because it seems more like an OpenSSL issue rather than a PHP one, although I can use this CA configuration to create certs from the command line, so there is something that PHP doesn't like about it.
When calling openssl_pkey_new() in PHP, I'm getting the error:
Error loading request_extensions_section section v3_req of /path/to/ca.config.
I'm passing the path of the ca.config file to openssl_pkey_new() via the config array, and PHP is opening the file.
The ca.config file looks like:
[ ca ]
default_ca = MyClientCA
[ crl_ext ]
issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always
[ MyClientCA ]
dir = /site/path/ssl/ca
new_certs_dir = $dir
unique_subject = no
certificate = $dir/MyClientCA.public
database = $dir/certindex
private_key = $dir/MyClientCA.key
serial = $dir/MyClientCA.srl
default_days = 3650
default_md = sha1
policy = myca_policy
x509_extensions = myca_extensions
crlnumber = $dir/crlnumber
default_crl_days = 730
[ myca_policy ]
commonName = supplied
stateOrProvinceName = supplied
countryName = optional
emailAddress = optional
organizationName = supplied
organizationalUnitName = optional
[ myca_extensions ]
basicConstraints = critical,CA:TRUE
keyUsage = critical,any
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
keyUsage = digitalSignature,keyEncipherment,cRLSign,keyCertSign
extendedKeyUsage = serverAuth
crlDistributionPoints = @crl_section
subjectAltName = @alt_names
authorityInfoAccess = @ocsp_section
[ v3_ca ]
basicConstraints = critical,CA:TRUE,pathlen:0
keyUsage = critical,any
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
keyUsage = digitalSignature,keyEncipherment,cRLSign,keyCertSign
extendedKeyUsage = serverAuth
crlDistributionPoints = @crl_section
subjectAltName = @alt_names
authorityInfoAccess = @ocsp_section
[alt_names]
DNS.0 = Sparkling Intermidiate CA 1
DNS.1 = Sparkling CA Intermidiate 1
[crl_section]
URI.0 = http://pki.sparklingca.com/SparklingRoot.crl
URI.1 = http://pki.backup.com/SparklingRoot.crl
[ocsp_section]
caIssuers;URI.0 = http://pki.sparklingca.com/SparklingRoot.crt
caIssuers;URI.1 = http://pki.backup.com/SparklingRoot.crt
OCSP;URI.0 = http://pki.sparklingca.com/ocsp/
OCSP;URI.1 = http://pki.backup.com/ocsp/
Unfortunately, the error error loading request_extensions_section section v3_req isn't very useful.
I don't have a request_extensions section in the file. There's an x509_extensions directive that points to myca_extensions but that doesn't seem to have anything wrong with it.
There isn't a v3_req section either. There's a v3_ca section, but again, I'm not seeing anything wrong with it.
How can I get more details about what's wrong with the configuration file?
Update
I've tried a bunch of things.
I tried copying the file from the system's default openssl.conf, but that just changes the error to:
error:0E06D06C:configuration file routines:NCONF_get_string:no value
There's quite a lot of people online asking about that error, but none have any useful replies.
I switched to a basic config:
[ ca ]
default_ca = ClientCA
[ ClientCA ]
dir = /path/var/ssl
new_certs_dir = $dir/pk12
unique_subject = no
certificate = $dir/ca/ClientCA.public
database = $dir/ca/certindex
private_key = $dir/ca/ClientCA.key
serial = $dir/ca/ClientCA.srl
default_days = 3650
default_md = sha256
policy = myca_policy
x509_extensions = myca_extensions
[ myca_policy ]
commonName = supplied
stateOrProvinceName = supplied
countryName = optional
emailAddress = optional
organizationName = supplied
organizationalUnitName = optional
[ myca_extensions ]
basicConstraints = CA:FALSE
keyUsage = critical,any
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
keyUsage = digitalSignature,keyEncipherment,cRLSign,keyCertSign
extendedKeyUsage = serverAuth
crlDistributionPoints = @crl_section
subjectAltName = @alt_names
authorityInfoAccess = @ocsp_section
But same error:
error:0E06D06C:configuration file routines:NCONF_get_string:no value
The config works just fine creating certs from the command line.
