diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2009-04-04 18:09:43 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2009-04-04 18:09:43 +0000 |
| commit | 326794e9c67107a9f9b0c285b7d0b8ed83773f62 (patch) | |
| tree | 076055647252d3d692106284e09caf906202537e | |
| parent | 2dd5ca1fbc15ed7473c8d96e62ed76ea2ab0d891 (diff) | |
Change default openssl.cnf to only use issuer+serial option in AKID if no
SKID.
| -rw-r--r-- | apps/openssl.cnf | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/apps/openssl.cnf b/apps/openssl.cnf index 7bcaa53ede..9d2cd5bfa5 100644 --- a/apps/openssl.cnf +++ b/apps/openssl.cnf @@ -231,7 +231,7 @@ keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectKeyIdentifier=hash -authorityKeyIdentifier=keyid:always,issuer:always +authorityKeyIdentifier=keyid:always,issuer # This is what PKIX recommends but some broken software chokes on critical # extensions. @@ -264,7 +264,7 @@ basicConstraints = CA:true # Only issuerAltName and authorityKeyIdentifier make any sense in a CRL. # issuerAltName=issuer:copy -authorityKeyIdentifier=keyid:always,issuer:always +authorityKeyIdentifier=keyid:always [ proxy_cert_ext ] # These extensions should be added when creating a proxy certificate @@ -297,7 +297,7 @@ nsComment = "OpenSSL Generated Certificate" # PKIX recommendations harmless if included in all certificates. subjectKeyIdentifier=hash -authorityKeyIdentifier=keyid,issuer:always +authorityKeyIdentifier=keyid,issuer # This stuff is for subjectAltName and issuerAltname. # Import the email address. |