From df5c86e9f80d14d699bad4c8889292fd9b4bd7ba Mon Sep 17 00:00:00 2001 From: Hugo Landau Date: Tue, 1 Mar 2022 12:55:03 +0000 Subject: Enable openssl req -x509 to create certificates from CSRs `openssl req -x509` has code allowing it to generate certificates from CSRs as a replacement for `openssl x509`, but a bug prevents it from working properly. -CA and -CAkey can now be passed to generate a CA-signed certificate as documented in openssl-req(1). Regression testing has been added to `openssl req`. Fixes #17736. Reviewed-by: Matt Caswell Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/17782) --- apps/req.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'apps') diff --git a/apps/req.c b/apps/req.c index 76b337f6bc..7e59e673e0 100644 --- a/apps/req.c +++ b/apps/req.c @@ -765,8 +765,9 @@ int req_main(int argc, char **argv) } } if (newreq || gen_x509) { - if (pkey == NULL /* can happen only if !newreq */) { - BIO_printf(bio_err, "Must provide a signature key using -key\n"); + if (CAcert == NULL && pkey == NULL) { + BIO_printf(bio_err, "Must provide a signature key using -key or" + " provide -CA / -CAkey\n"); goto end; } -- cgit v1.2.3