Commit 29b9763d authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Change openssl.cnf to use UTF8Strings by default and not always include issuer 

and serial versions of AKID.
parent 270da80b

apps/openssl.cnf

+5 −6
Original line number Diff line number Diff line
@@ -110,13 +110,12 @@ x509_extensions = v3_ca # The extentions to add to the self signed cert 


# This sets a mask for permitted string types. There are several options. 

# default: PrintableString, T61String, BMPString.

# pkix	 : PrintableString, BMPString.

# utf8only: only UTF8Strings.

# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)

# utf8only: only UTF8Strings (PKIX recommendation after 2004).

# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).

# MASK:XXXX a literal mask value.

# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings

# so use this option with caution!

string_mask = nombstr

# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.

string_mask = utf8only



# req_extensions = v3_req # The extensions to add to a certificate request
@@ -188,7 +187,7 @@ nsComment = "OpenSSL Generated Certificate" 


# PKIX recommendations harmless if included in all certificates.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid,issuer:always

authorityKeyIdentifier=keyid,issuer



# This stuff is for subjectAltName and issuerAltname.

# Import the email address.