v1 vs v3? about openssl-ca

[jersam]

Since chrome 59* hit the shelves I've been having issues with this one. Any idea for a fix on your end?

[llekn]

Hi @jersam I'm sorry about the delay, I just had now the time to look on this.

Apparently there was a missing -extensions param while creating the CSR and certificate, so v3 extensions were not added to the resultant cert (despite being specified on the openssl.cnf file! Welcome to OpenSSL hell)

I've just pushed to branch v3-fix a commit that should solve your problem. Could you pull this branch and confirm that now certs are working con Chrome 56+ ?

[jersam]

Awesome! I'll give it a try on Monday Thank you!

…

On Sat, Jul 15, 2017, 7:52 PM Camilo Flores ***@***.***> wrote: Hi @jersam <https://github.com/jersam> I'm sorry about the delay, I just had now the time to look on this. Apparently there was a missing -extensions param while creating the CSR and certificate, so v3 extensions were not added to the resultant cert (despite being specified on the openssl.cnf file! Welcome to OpenSSL hell) I've just pushed to branch v3-fix a commit that should solve your problem. Could you pull this branch and confirm that now certs are working con Chrome 56+ ? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AQ3D8F8IEVbxwzbgMYN4LZqhAgZi0p7Dks5sOXrjgaJpZM4N5I4b> .

[jersam]

if i have a.dev which needs to 'renew' after pulling the branch, how do I go about 'renewals' haha....

[llekn]

You will have to update the index manually as currently there is no automated way about how to overwrite already issued certificates. To update the index and reissue certificates:

• Open ./index.txt and remove the lines of those certificates you want to reissue
• Run create_crt.sh to create a new key, CSR and certificate (or run create_csr.sh and sign_csr.sh if you do not want to create a new key

This should overwrite the certificates (and or CSR/key) files on the ./out folder

Let me know if I can help to test this.

[jersam]

Looks to be the fix

thanks!!!

[llekn]

@jersam great!

Merged in #3