Change default openssl.cnf to only use issuer+serial option in AKID if no (326794e9) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

apps/openssl.cnf

+3 −3

Original line number	Diff line number	Diff line
		@@ -231,7 +231,7 @@ keyUsage = nonRepudiation, digitalSignature, keyEncipherment

		subjectKeyIdentifier=hash

		authorityKeyIdentifier=keyid:always,issuer:always
		authorityKeyIdentifier=keyid:always,issuer

		# This is what PKIX recommends but some broken software chokes on critical
		# extensions.
		@@ -264,7 +264,7 @@ basicConstraints = CA:true
		# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

		# issuerAltName=issuer:copy
		authorityKeyIdentifier=keyid:always,issuer:always
		authorityKeyIdentifier=keyid:always

		[ proxy_cert_ext ]
		# These extensions should be added when creating a proxy certificate
		@@ -297,7 +297,7 @@ nsComment = "OpenSSL Generated Certificate"

		# PKIX recommendations harmless if included in all certificates.
		subjectKeyIdentifier=hash
		authorityKeyIdentifier=keyid,issuer:always
		authorityKeyIdentifier=keyid,issuer

		# This stuff is for subjectAltName and issuerAltname.
		# Import the email address.