Howto create a certificate using openssl including a CRL distribution point?

Question

I'm having problems using openssl to create a x509 certificate containing a crl distribution point for testing.

I've checked the documentation and found the configuration setting crlDistributionPoints for this purpose. Unfortunately openssl always generates x509 version 1 certificates without instead of version 3 certificates with the crl distribution point. I'm sure something is wrong with my command or the configuration but reading the documentation carefully and playing around with the configuration did not help. Other settings from the configuration file are considered so I'm sure the file itself is used by openssl.

I'm using the command

openssl x509 -req -in $NAME.csr -out certs/$NAME.pem -days 3650 -CAcreateserial -CA cacert.pem -CAkey private/cakey.pem -CAserial serial

I'm using the following configuration file:

[ ca ]
default_ca              = CA_default

[ CA_default ]

dir                     = /home/ca
database                = $dir/index.txt
new_certs_dir           = $dir/newcerts

certificate             = $dir/cacert.pem
serial                  = $dir/serial
private_key             = $dir/private/cakey.pem
RANDFILE                = $dir/private/.rand

default_days            = 3650
default_crl_days        = 30
default_md              = md5

policy                  = policy_any
email_in_dn             = no

name_opt                = ca_default
cert_opt                = ca_default
copy_extensions         = none

x509_extensions         = extensions_section

[ extensions_section ]

crlDistributionPoints=URI:http://example.com/crl.pem

[ policy_any ]
countryName             = supplied
stateOrProvinceName     = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

Any ideas?

Answer 1

openssl x509 does not read the extensions configuration you've specified above in your config file.

You can get the crlDistributionPoints into your certificate in (at least) these two ways:

1. Use openssl ca rather than x509 to sign the request. Pass -config as needed if your config is not in a default location. Most of your provided command can be used if you omit the options starting with -CA

   openssl ca -in $NAME.csr -out certs/$NAME.pem -days 3650

2. Use the command as you've provided in your question, but first create a file containing your v3 extensions (ie mycrl.cnf); add the option -extfile mycrl.cnf to your call to openssl x509

   openssl x509 -req -in $NAME.csr -out certs/$NAME.pem -days 3650 \
     -CAcreateserial -CA cacert.pem -CAkey private/cakey.pem \
     -CAserial serial -extfile mycrl.cnf`
   

   Where mycrl.cnf contains the following:

   crlDistributionPoints=URI:http://example.com/crl.pem

openssl ca is probably the command better suited to what you want to do, since most examples you will find rely on that command utilizing various settings in openssl.cnf for v3 extensions.

An aside: it is inadvisable to use MD5 message digest in certificates.

Previously SHA1 was the suggested alternative to MD5, however that too is now becoming deprecated. You can specify the message digest used in requests and signing operations, and you can list the supported message digests with openssl list-message-digest-commands.

As an example, you can use SHA256 when signing a request with the -md sha256 option to openssl ca ( or setting default_md=sha256 in your [CA_default] config section).