1

I did a bunch of searching, but I couldn't find an answer. I'm posting this here because it seems more like an OpenSSL issue rather than a PHP one, although I can use this CA configuration to create certs from the command line, so there is something that PHP doesn't like about it.

When calling openssl_pkey_new() in PHP, I'm getting the error:

Error loading request_extensions_section section v3_req of /path/to/ca.config.

I'm passing the path of the ca.config file to openssl_pkey_new() via the config array, and PHP is opening the file.

The ca.config file looks like:

[ ca ]
default_ca = MyClientCA

[ crl_ext ]
issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always

[ MyClientCA ]
dir = /site/path/ssl/ca
new_certs_dir = $dir
unique_subject = no
certificate = $dir/MyClientCA.public
database = $dir/certindex
private_key = $dir/MyClientCA.key
serial = $dir/MyClientCA.srl
default_days = 3650
default_md = sha1
policy = myca_policy
x509_extensions = myca_extensions
crlnumber = $dir/crlnumber
default_crl_days = 730

[ myca_policy ]
commonName = supplied
stateOrProvinceName = supplied
countryName = optional
emailAddress = optional
organizationName = supplied
organizationalUnitName = optional

[ myca_extensions ]
basicConstraints = critical,CA:TRUE
keyUsage = critical,any
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
keyUsage = digitalSignature,keyEncipherment,cRLSign,keyCertSign
extendedKeyUsage = serverAuth
crlDistributionPoints = @crl_section
subjectAltName  = @alt_names
authorityInfoAccess = @ocsp_section

[ v3_ca ]
basicConstraints = critical,CA:TRUE,pathlen:0
keyUsage = critical,any
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
keyUsage = digitalSignature,keyEncipherment,cRLSign,keyCertSign
extendedKeyUsage = serverAuth
crlDistributionPoints = @crl_section
subjectAltName  = @alt_names
authorityInfoAccess = @ocsp_section

[alt_names]
DNS.0 = Sparkling Intermidiate CA 1
DNS.1 = Sparkling CA Intermidiate 1

[crl_section]
URI.0 = http://pki.sparklingca.com/SparklingRoot.crl
URI.1 = http://pki.backup.com/SparklingRoot.crl

[ocsp_section]
caIssuers;URI.0 = http://pki.sparklingca.com/SparklingRoot.crt
caIssuers;URI.1 = http://pki.backup.com/SparklingRoot.crt
OCSP;URI.0 = http://pki.sparklingca.com/ocsp/
OCSP;URI.1 = http://pki.backup.com/ocsp/

Unfortunately, the error error loading request_extensions_section section v3_req isn't very useful.

I don't have a request_extensions section in the file. There's an x509_extensions directive that points to myca_extensions but that doesn't seem to have anything wrong with it.

There isn't a v3_req section either. There's a v3_ca section, but again, I'm not seeing anything wrong with it.

How can I get more details about what's wrong with the configuration file?

Update

I've tried a bunch of things.

I tried copying the file from the system's default openssl.conf, but that just changes the error to:

error:0E06D06C:configuration file routines:NCONF_get_string:no value

There's quite a lot of people online asking about that error, but none have any useful replies.

I switched to a basic config:

[ ca ]
default_ca = ClientCA

[ ClientCA ]
dir = /path/var/ssl
new_certs_dir = $dir/pk12
unique_subject = no
certificate = $dir/ca/ClientCA.public
database = $dir/ca/certindex
private_key = $dir/ca/ClientCA.key
serial = $dir/ca/ClientCA.srl
default_days = 3650
default_md = sha256
policy = myca_policy
x509_extensions = myca_extensions

[ myca_policy ]
commonName = supplied
stateOrProvinceName = supplied
countryName = optional
emailAddress = optional
organizationName = supplied
organizationalUnitName = optional

[ myca_extensions ]
basicConstraints = CA:FALSE
keyUsage = critical,any
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
keyUsage = digitalSignature,keyEncipherment,cRLSign,keyCertSign
extendedKeyUsage = serverAuth
crlDistributionPoints = @crl_section
subjectAltName  = @alt_names
authorityInfoAccess = @ocsp_section

But same error:

error:0E06D06C:configuration file routines:NCONF_get_string:no value

The config works just fine creating certs from the command line.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.