Fix-up certificate generation: remove extensions related to certificate authority, add key usages for key exchange and signature.

This commit is contained in:
tezcatli 2017-02-26 15:05:26 +01:00 committed by Iwan Timmer
parent 9301898630
commit 5bac18519c

View File

@ -129,8 +129,7 @@ int mkcert(X509 **x509p, EVP_PKEY **pkeyp, int bits, int serial, int years) {
X509_set_issuer_name(x, name);
/* Add various extensions: standard extensions */
add_ext(x, NID_basic_constraints, "critical,CA:TRUE");
add_ext(x, NID_key_usage, "critical,keyCertSign,cRLSign");
add_ext(x, NID_key_usage, "critical,digitalSignature,keyEncipherment");
add_ext(x, NID_subject_key_identifier, "hash");