Skip to content

Conversation

@from-axioms
Copy link

@from-axioms from-axioms commented Jan 30, 2024

Tested this with basic script (where server was verifying the below extensions) and this works.

getCertUnsigned :: IO X509
getCertUnsigned = do
deviceCSR <- readFile "new_csr.pem"
x509Object <- readX509Req deviceCSR
issuerCert <- getIssuerCert
x509Cert <- makeX509FromReq x509Object issuerCert
setSerialNumber x509Cert 112312
now <- getCurrentTime
setNotBefore x509Cert $ addUTCTime (-100) now
setNotAfter x509Cert $ addUTCTime (365 * 24 * 60 * 60) now
addExtensionToX509 x509Cert 87 "CA:FALSE"
addExtensionToX509 x509Cert 83 "digitalSignature, keyEncipherment"
addExtensionToX509 x509Cert 85 "serverAuth, clientAuth"

pure x509Cert

@from-axioms
Copy link
Author

@vshabanov Can you review this change? Let me know if anything is not clear.

@vshabanov vshabanov merged commit 7021043 into haskell-cryptography:master Jun 11, 2024
@vshabanov
Copy link
Collaborator

Thank you. It's now available in HsOpenSSL-0.11.7.7

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants