主页 / unix / 问题 / 791660
Accepted
eftshift0
Asked: 2025-02-26 16:29:04 +0800 CST

openssl - 是否可以使用 openssl 3.2 生成 V1 x.509 ca 证书？

  • 772

在 openssl 3.0.7 中，我可以在 openssl-ca 手册页中看到这一点：

       -extensions section
           The section of the configuration file containing certificate extensions to be added when a certificate is issued (defaults to x509_extensions unless the
           -extfile option is used).  If no X.509 extensions are specified then a V1 certificate is created, else a V3 certificate is created.  See the
           x509v3_config(5) manual page for details of the extension section format.

但是在 openssl 3.2.2 中，它没有提及 V1：

       -extensions section
           The section of the configuration file containing certificate extensions to be added when a certificate is issued (defaults to x509_extensions unless the
           -extfile option is used).

           See the x509v3_config(5) manual page for details of the extension section format.

是否不再可能生成使用 V1 的证书？

openssl

1 个回答

  1. Best Answer

    快速回答：不，你不能。在 openssl 3.2.0 的发行说明中，明确指出 V1 将不再使用：

    - The x509, ca, and req apps now always produce X.509v3 certificates.

    https://openssl-library.org/news/openssl-3.2-notes/

    • 1

相关问题