diff options
author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2022-09-24 23:59:12 +0200 |
---|---|---|
committer | Dr. David von Oheimb <dev@ddvo.net> | 2023-01-24 15:16:47 +0100 |
commit | 342e3652c791bdb06e08abcc169b4456c83ccd00 (patch) | |
tree | 87190b58432cd73cc8dd1d4bfd9dfd027f2f236f /doc/man5/x509v3_config.pod | |
parent | 66fc90f18c44cdac0126c35ffedb99ba7a8b9825 (diff) | |
download | openssl-342e3652c791bdb06e08abcc169b4456c83ccd00.tar.gz |
APPS: generated certs bear X.509 V3, unless -x509v1 option of req app is given
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19271)
Diffstat (limited to 'doc/man5/x509v3_config.pod')
-rw-r--r-- | doc/man5/x509v3_config.pod | 24 |
1 files changed, 19 insertions, 5 deletions
diff --git a/doc/man5/x509v3_config.pod b/doc/man5/x509v3_config.pod index e369997b60..cf42e9053a 100644 --- a/doc/man5/x509v3_config.pod +++ b/doc/man5/x509v3_config.pod @@ -173,14 +173,27 @@ Examples: =head2 Subject Key Identifier The SKID extension specification has a value with three choices. -If the value is the word B<none> then no SKID extension will be included. -If the value is the word B<hash>, or by default for the B<x509>, B<req>, and -B<ca> apps, the process specified in RFC 5280 section 4.2.1.2. (1) is followed: + +=over 4 + +=item B<none> + +No SKID extension will be included. + +=item B<hash> + +The process specified in RFC 5280 section 4.2.1.2. (1) is followed: The keyIdentifier is composed of the 160-bit SHA-1 hash of the value of the BIT STRING subjectPublicKey (excluding the tag, length, and number of unused bits). -Otherwise, the value must be a hex string (possibly with C<:> separating bytes) -to output directly, however, this is strongly discouraged. +=item A hex string (possibly with C<:> separating bytes) + +The provided value is output directly. +This choice is strongly discouraged. + +=back + +By default the B<x509>, B<req>, and B<ca> apps behave as if B<hash> was given. Example: @@ -195,6 +208,7 @@ or both of them, separated by C<,>. Either or both can have the option B<always>, indicated by putting a colon C<:> between the value and this option. For self-signed certificates the AKID is suppressed unless B<always> is present. + By default the B<x509>, B<req>, and B<ca> apps behave as if B<none> was given for self-signed certificates and B<keyid>C<,> B<issuer> otherwise. |