Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:pb_openssl_error_loading_extension_section_v3_ca [2025/03/24 15:06] – créée - modification externe 127.0.0.1
+++ tech:pb_openssl_error_loading_extension_section_v3_ca [2026/06/07 19:12] (Version actuelle) – modification externe 127.0.0.1
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>Pb Brouillon TLS}}
+# Pb OpenSSL LibreSSL Error Loading extension section v3_ca
+Voir aussi :
+  * https://knowledge.digicert.com/solution/what-extensions-and-details-are-included-in-a-ssl-certificate
+~~~bash
+$ openssl genrsa -des3 -out macle.key 2048
+#Voir aussi "openssl ecparam -genkey" pour Elliptic Curve key
+Generating RSA private key, 2048 bit long modulus
+................................................+++
+...................................................+++
+e is 65537 (0x10001)
+Enter pass phrase for macle.key:
+Verifying - Enter pass phrase for macle.key:
+~~~
+~~~
+$ openssl req -new -x509 -days 3650 -key macle.key -sha256 -extensions v3_ca -out macle.crt
+Error Loading extension section v3_ca
+~~~
+Le problème venait de LibreSSL (pourquoi !?)
+Solution 1 (rapide) :
+Spécifier le chemin pour prendre l'openssl de la distribution GNU/Linux
+~~~bash
+/usr/bin/openssl req -new -x509 -days 3650 -key macle.key -sha256 -extensions v3_ca -out macle.crt
+~~~
+Solution 2 (la bonne) :
+~~~bash
+mv /usr/local/etc/ssl{,.old}
+ln -s /etc/ssl /usr/local/etc/ssl
+~~~
+En effet, la conf n'est pas la même
+~~~
+# grep -ri v3_ca /etc/ssl
+/etc/ssl/openssl.cnf:x509_extensions	= v3_ca	# The extentions to add to the self signed cert
+/etc/ssl/openssl.cnf:[ v3_ca ]
+~~~
+`openssl.cnf`
+~~~ini
+[ v3_ca ]
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid:always,issuer
+basicConstraints = CA:true
+[ req ]
+x509_extensions = v3_ca # The extentions to add to the self signed cert
+~~~
+## Autres
+~~~
+$  openssl x509 -ext basicConstraints,keyUsage -noout -in /usr/share/ca-certificates/mozilla/VeriSign_Universal_Root_Certification_Authority.crt
+X509v3 Basic Constraints: critical
+    CA:TRUE
+X509v3 Key Usage: critical
+    Certificate Sign, CRL Sign
+~~~