opensslx509certificatex509csr

Not getting version 3 when creating a csr file with openssl

I'm beeing asked to create a csr (certificate signing request) in order to then send this to an entity that will create the certificate.

My problem is, I'm able to create the private key, and the csr, but I have to create it with version 3. I've not figured out if it's possible because it's like however I try, I just can get the version 3 just if I create myself a certificate. But not with the certificate request.

This is how I generate the private key:

openssl ecparam -genkey -name prime256v1 -out private.pem

My configuration file (x509Version3.cnf) is like that:

[ req ]
prompt              = no
encrypt_key         = no
default_bits        = 2048
distinguished_name  = req_distinguished_name
x509_extensions     = v3_req

[ req_distinguished_name ]
commonName          = 434C800000012A

[ v3_req ]
keyUsage            = critical, digitalSignature
# keyUsage          = critical,keyAgreement
basicConstraints    = CA:FALSE

Then in order to get the certificate request I'm using:

openssl req -new -key private.pem -out certificateRequest.pem -config x509Version3.cnf -reqexts v3_req

And this generates a certificate request but when I check it's content with for example this web, I get:

enter image description here

But if I create the certificate by it self, with the command:

openssl req -x509 -new -key private.pem -out certificate.pem -days 365 -config x509Version3.cnf -extensions v3_req

I'm getting the one I'm expecting: enter image description here

What I'm doing wrong? I've been checking the params for openssl certificate request, and they all seem correct and doing as expected.

Is it possible to have version 3 in a certificate request? Or just once it's a certificate created?

Thank you very much!

Solution

  • Currently, only one version for PKCS#10 CSR is defined, it is version 1 (encoded as 0). What you see in CSR dump is correct, by design and expected.

    Signed certificate is a very different object (not PKCS#10) and it has three versions: v1 (very old that supports only mandatory fields, no extensions allowed), v2 (seldom ever used) and v3, current X.509 certificate format that supports certificate extensions.

    That is, you generate V1 request and after signing, receive V3 X.509 certificate.