make certificate with make is only 1 month valid
Hi, I was just wondering why the Makefile in freeradius 2.0 for creating certificates only produces a CA which is valid for 1 month. I don't reckon that's handy for production use. Is there any particular reason? Changing the ca.cnf file doesn't change it? Adding "-days 3650" to the Makefile helps though but that's no fix just a workaround IMHO. Rg, Arnaud -- View this message in context: http://www.nabble.com/make-certificate-with-make-is-only-1-month-valid-tp196... Sent from the FreeRadius - User mailing list archive at Nabble.com.
sphaero wrote:
I was just wondering why the Makefile in freeradius 2.0 for creating certificates only produces a CA which is valid for 1 month. I don't reckon that's handy for production use.
They are "test" certificates. For production use you need to edit the OpenSSL configuration files.
Is there any particular reason? Changing the ca.cnf file doesn't change it?
Maybe it's a bug in OpenSSL.
Adding "-days 3650" to the Makefile helps though but that's no fix just a workaround IMHO.
If it's the only way to do it, it's a fix. Alan DeKok.
Alan DeKok-2 wrote:
sphaero wrote:
I was just wondering why the Makefile in freeradius 2.0 for creating certificates only produces a CA which is valid for 1 month. I don't reckon that's handy for production use.
They are "test" certificates. For production use you need to edit the OpenSSL configuration files.
Well according to your site the instructions are for production use. http://deployingradius.com/ link to "Create certificates for production use." Rg, Arnaud -- View this message in context: http://www.nabble.com/make-certificate-with-make-is-only-1-month-valid-tp196... Sent from the FreeRadius - User mailing list archive at Nabble.com.
It's not exactly a bug in openSSL. Just weirdness: openssl req command options: "-days n when the -x509 option is being used this specifies the number of days to certify the certificate for. The default is 30 days." It looks like default_days setting in ca.cnf is irrelevant. Ivan Kalik Kalik Informatika ISP Dana 22/9/2008, "sphaero" <arnaud@sphaero.org> piše:
Alan DeKok-2 wrote:
sphaero wrote:
I was just wondering why the Makefile in freeradius 2.0 for creating certificates only produces a CA which is valid for 1 month. I don't reckon that's handy for production use.
They are "test" certificates. For production use you need to edit the OpenSSL configuration files.
Well according to your site the instructions are for production use.
http://deployingradius.com/ link to "Create certificates for production use."
Rg,
Arnaud
-- View this message in context: http://www.nabble.com/make-certificate-with-make-is-only-1-month-valid-tp196... Sent from the FreeRadius - User mailing list archive at Nabble.com.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
tnt@kalik.net wrote:
It's not exactly a bug in openSSL. Just weirdness: ... It looks like default_days setting in ca.cnf is irrelevant.
i.e. OpenSSL ignores a configuration that is documented as doing something. That sounds like a bug to me. A few simple searches on google found other people running into this problem, too. Alan DeKok.
http://marc.info/?l=openssl-users&m=110958909114203&w=2 That's from 2005. They know about it. And don't care. Ivan Kalik Kalik Informatika ISP Dana 22/9/2008, "Alan DeKok" <aland@deployingradius.com> piše:
tnt@kalik.net wrote:
It's not exactly a bug in openSSL. Just weirdness: .... It looks like default_days setting in ca.cnf is irrelevant.
i.e. OpenSSL ignores a configuration that is documented as doing something. That sounds like a bug to me.
A few simple searches on google found other people running into this problem, too.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
A workaround for the Makefile would be to add: CA_DEF_DAYS = `grep default_days ca.cnf | sed 's/.*=//;s/^ *//' to the Makefile and change line 55: ca.key ca.pem: ca.cnf openssl req -new -x509 -keyout ca.key -out ca.pem -days $(CA_DEF_DAYS) -config ./ca.cnf This has worked for me. I've set default_days to 3650 and tested the Makefile: openssl x509 -in ca.pem -noout -dates notBefore=Sep 21 10:11:53 2008 GMT notAfter=Sep 19 10:11:53 2018 GMT -- View this message in context: http://www.nabble.com/make-certificate-with-make-is-only-1-month-valid-tp196... Sent from the FreeRadius - User mailing list archive at Nabble.com.
sphaero wrote:
Well according to your site the instructions are for production use.
And according to the email which you quoted:
Is there any particular reason? Changing the ca.cnf file doesn't change it?
Maybe it's a bug in OpenSSL.
But you deleted that portion. By selectively editing && quoting my text, you tried to make it look like I was disagreeing with the documentation I wrote. Nice try. It just makes you look dumb. Alan DeKok.
participants (3)
-
Alan DeKok -
sphaero -
tnt＠kalik.net