Re: RFC 5280 and example of a self signed end-entity certificate?

Jeff,
the command
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -nodes

creates not an *EE* certificate but a CA certificate (cA is TRUE).
An EE-certificate has by definition not other certs below, it is a leaf
of the certification path. Therefore in the basicContraints field cA
must be set to FALSE.

E.g.
-----BEGIN CERTIFICATE-----
MIIDWjCCAkKgAwIBAgIJAPJdD4BBetgeMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
aWRnaXRzIFB0eSBMdGQwHhcNMTYxMTI1MDcxNjA1WhcNMTYxMjI1MDcxNjA1WjBF
MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAxCFKIale9wC6EPQmy4TY2K1NWIqMHnNusRpNtvpDmkKNbnZ/veH3bucr
8/gKtdTsDRJfsT/5m+L3QAOrAHkI6xDYxW0JmhTLrnrfh4sIQtKy7Fkzjl46h92l
M3SoUy6s3SAeV1nF4Aa8bmK+cgWo+NJ7Xegdyt3DHIyVFNWD1G88qZKt8MU8Bskk
16/bpA40GtLVNn+8ALwTjR6F3R0ww8QhtiC+EttQE/lb/bk8LvDJwtU3aUMgrA9g
/LWDAWMB/xPRKNcVDJ0Yuug02zgBvtQhSniw5gGwuBQ+YWONuORpLD6NPMjKr75L
bGAD9nd1HSDI+jcSUIa72Ave9+L3xQIDAQABo00wSzAdBgNVHQ4EFgQU8Yb5SHNN
4H/QSa5RTuy62+NLVbwwHwYDVR0jBBgwFoAU8Yb5SHNN4H/QSa5RTuy62+NLVbww
CQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEACs5ElEzMLJo1XYDBViguS3Is
hg57W4Y/yAPFQPdYSaIays1/2qmKgYDzbD7UK7HszXPmECBpNhxxMMWe2X/pOtj2
fjgd9B7dhUZF7yh56lvQz8SwEC3b2CKHp/HwqHwCVTyFLySoZomP4cr07jIJZL1L
jcIWpITcErCU8xOZeT1cjBSP5oCDx0pW2coo1bt3YGtbLpoJ+AkYtD2SXldNTVsu
rBNHKHpOklwrLwOSuJbTzJ6f0UzNLHHjHXrNzXH8vlhMEZzlEnq1cBGnmjEiKwGT
PyyoH/yPQIvnjxGySjtnpts/b7qvhOlanr+9ItqpgLBLnJ4PRWgarr+WeaTm8g==
-----END CERTIFICATE-----

Check it with the OpenSSL command
openssl verify -CAfile cert.pem cert.pem

Nevertheless I'm not sure that this is correct because the cert is not a
*CAfile*.

Regards,
/Ann.

The SHA-1 issue could be solved easier: add the option -sha256.

Am 24.11.2016 um 23:56 schrieb Jeffrey Walton:
> On Sun, Nov 20, 2016 at 2:06 AM, Yoav Nir <[email protected]> wrote:
>>
>> On 20 Nov 2016, at 8:56, Peter Gutmann <[email protected]> wrote:
>>
>> Jeffrey Walton <[email protected]> writes:
>>
>> Does anyone know where I might find an example of a elf-signed end-entity
>> certificate?
>>
>>
>> By finding an elf and getting them to sign one for you?  Alternatively, if
>> you
>> want a *self*-signed EE cert, by signing one yourself?  Or am I missing
>> something here…
>>
>>
>> I think you’re missing this:
>>
>> openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
>> -nodes
> 
> Forgive m if I am wrong... That creates a malformed server certificate
> because the hostname is placed in the CN and not the SAN, it uses SHA1
> by default, and it fails to use UTF-8 strings by default. At minimum,
> its not following best practices and using deprecated methods.
> 
> I'm also interested in seeing  what an "ideal" or "minimal" client
> certificate should look like. Especially how a principal name, like
> "jdoe" (used as a corporate login), should appear since its probably
> distinct from the Subject DN.
> 
> Jeff
> 
> _______________________________________________
> pkix mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/pkix
> 

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix