not requiring same org as ca

kiemlicz · Dec 30, 2023 · 0661d57 · 0661d57
1 parent 5717694
commit 0661d57
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/sec/cert_functions b/sec/cert_functions
@@ -205,6 +205,7 @@ gen_csr_sign() {
     # todo create method accepting ca files as arg
     # check if this aids -CAcreateserial for those stupid files creation
     BASE_DIR=$4 openssl ca -config $3 -batch -days ${5-10000} -notext -md sha256 -in $1 -out $2
+    # if signing intermediate CA, add: -extensions v3_intermediate_ca
 }
 
 # generate certificate revocation list

diff --git a/sec/openssl-ca.cnf b/sec/openssl-ca.cnf
@@ -33,7 +33,8 @@ name_opt          = ca_default
 cert_opt          = ca_default
 default_days      = 375
 preserve          = no
-policy            = policy_strict
+# policy            = policy_strict
+policy            = policy_loose
 
 copy_extensions   = copy