http://bugzilla.opensuse.org/show_bug.cgi?id=1194187 http://bugzilla.opensuse.org/show_bug.cgi?id=1194187#c1 Marcus R�ckert <mrueckert@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mpost@suse.com --- Comment #1 from Marcus R�ckert <mrueckert@suse.com> --- worked around it by commenting out: ``` # oid_section = new_oids # engines = engine_section ``` -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1194187 http://bugzilla.opensuse.org/show_bug.cgi?id=1194187#c4 Marcus R�ckert <mrueckert@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(mrueckert@suse.co | |m) | --- Comment #4 from Marcus R�ckert <mrueckert@suse.com> --- The call that triggers it is: "openssl req -new -sha256 -key /etc/dehydrated/certs/keyname_rsa/privkey-1640907684.pem -out /etc/dehydrated/certs/keyname_rsa/cert-1640907684.csr -subj /CN=keyname/ -reqexts SAN -config /tmp/dehydrated-DwFNuo" /tmp/dehydrated-DwFNuo is a copy of our /etc/ssl/openssl.cnf with a `[SAN]` section attached. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1194187 http://bugzilla.opensuse.org/show_bug.cgi?id=1194187#c7 Mark Post <mpost@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(mrueckert@suse.co | |m) --- Comment #7 from Mark Post <mpost@suse.com> --- (In reply to Marcus R�ckert from comment #6)

cp /etc/ssl/openssl.cnf /tmp/dehydrated-DwFNuo

Add something like

``` [SAN] subjectAltName=DNS:host1, DNS:host2 ```

Thanks, Marcus. Now I have to ask you to create something I can use for /etc/dehydrated/certs/keyname_rsa/privkey-1640907684.pem to see what's going on. Obviously I don't want you to send me a "real" private key, but something that gets created the same way would be really nice. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1194187 http://bugzilla.opensuse.org/show_bug.cgi?id=1194187#c9 --- Comment #9 from Mark Post <mpost@suse.com> --- Thanks again. In playing around, it seems there is some sort of issue with the addition of these two lines: openssl_conf = openssl_init [openssl_init] When I added those, I was following the documentation at https://www.openssl.org/docs/man1.1.1/man5/config.html If I remove them or comment them out, the CSR file gets created, but the engines definitions don't get created, even though the include files are read. It's as though these two lines are being totally ignored without the section header: oid_section = new_oids engines = engine_section Which seems odd, since the documentation says: The first section of a configuration file is special and is referred to as the default section. This section is usually unnamed and spans from the start of file until the first named section. Without those two lines, the old_section and engines lines should be considered as being in the default section. This is starting to look more like an openssl bug to me, rather than the changes I made being somehow wrong. Just what that means for Marcus adding the [SAN] section for his needs is really not clear. It seems as though his particular command only requires the "[ req_distinguished_name ]" section from openssl.cnf. But, none of those values are customized by us, so it's all very generic. I don't know enough about openssl to be sure, but this kind of looks like this is relevant: https://github.com/openssl/openssl/issues/4598#issuecomment-341321065 Pedro, if you could take a look at this, I would appreciate it. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1194187 http://bugzilla.opensuse.org/show_bug.cgi?id=1194187#c29 --- Comment #29 from Mark Post <mpost@suse.com> --- Based on what Pedro said, upstream is not willing to fix it. -- You are receiving this mail because: You are on the CC list for the bug.