mirror of
https://github.com/3proxy/3proxy.git
synced 2026-09-02 21:05:49 +08:00
fc544c4dff
The CA was created with no extensions, so it is not usable as a CA and clients report that they cannot get the local issuer certificate. Add basicConstraints, keyCertSign and a subject key identifier, in a file rather than through -addext, which LibreSSL - the openssl on macOS and some BSDs - does not apply the same way. Ask for the key identifiers on the signed certificates too: OpenSSL 3 adds them when it signs and LibreSSL does not, and Python has verified strictly since 3.13, refusing a chain whose certificate carries no authorityKeyIdentifier. Finish with openssl verify -x509_strict, which is the check the client will make. Both recipes were run against OpenSSL 3.6 and LibreSSL 3.3: the old one fails strict verification, the new one passes on both. |
||
|---|---|---|
| .. | ||
| changelog | ||
| html | ||
| ru | ||