Re: RFC 5280 and example of a self signed end-entity certificate?

On Sun, Nov 20, 2016 at 2:06 AM, Yoav Nir <[email protected]> wrote:
>
> On 20 Nov 2016, at 8:56, Peter Gutmann <[email protected]> wrote:
>
> Jeffrey Walton <[email protected]> writes:
>
> Does anyone know where I might find an example of a elf-signed end-entity
> certificate?
>
>
> By finding an elf and getting them to sign one for you?  Alternatively, if
> you
> want a *self*-signed EE cert, by signing one yourself?  Or am I missing
> something here…
>
>
> I think you’re missing this:
>
> openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
> -nodes

Forgive m if I am wrong... That creates a malformed server certificate
because the hostname is placed in the CN and not the SAN, it uses SHA1
by default, and it fails to use UTF-8 strings by default. At minimum,
its not following best practices and using deprecated methods.

I'm also interested in seeing  what an "ideal" or "minimal" client
certificate should look like. Especially how a principal name, like
"jdoe" (used as a corporate login), should appear since its probably
distinct from the Subject DN.

Jeff

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix