I'm having problems using openssl to create a x509 certificate containing a crl distribution point for testing.
I've checked the documentation and found the configuration setting crlDistributionPoints for this purpose. Unfortunately openssl always generates x509 version 1 certificates without instead of version 3 certificates with the crl distribution point. I'm sure something is wrong with my command or the configuration but reading the documentation carefully and playing around with the configuration did not help. Other settings from the configuration file are considered so I'm sure the file itself is used by openssl.
I'm using the command
openssl x509 -req -in $NAME.csr -out certs/$NAME.pem -days 3650 -CAcreateserial -CA cacert.pem -CAkey private/cakey.pem -CAserial serial
I'm using the following configuration file:
[ ca ]
default_ca = CA_default
[ CA_default ]
dir = /home/ca
database = $dir/index.txt
new_certs_dir = $dir/newcerts
certificate = $dir/cacert.pem
serial = $dir/serial
private_key = $dir/private/cakey.pem
RANDFILE = $dir/private/.rand
default_days = 3650
default_crl_days = 30
default_md = md5
policy = policy_any
email_in_dn = no
name_opt = ca_default
cert_opt = ca_default
copy_extensions = none
x509_extensions = extensions_section
[ extensions_section ]
crlDistributionPoints=URI:http://example.com/crl.pem
[ policy_any ]
countryName = supplied
stateOrProvinceName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
Any ideas?