Openssl invalid_purpose

Question

What certificate fields are viewed when Openssl generates invalid_purpose?

I generate certificates using OpenSSL.

First, I create a master certificate, followed by a client certificate. Now, when I try to connect to the server, it generates Invalid_Purpose.

Answer 1

There is a keyUsage extension that indicates what can be done with the certificate. Please note that some programs do not use this field.

From the X509 documentation:

 X509_V_ERR_INVALID_PURPOSE: unsupported certificate purpose the supplied certificate cannot be used for the specified purpose. 

Man x509v3_config (5) lists the possible values ​​for the parameter, as well as for another, called extendedKeyUsage :

 Key Usage. Key usage is a multi valued extension consisting of a list of names of the permitted key usages. The supporte names are: digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly and decipherOnly. Examples: keyUsage=digitalSignature, nonRepudiation keyUsage=critical, keyCertSign Extended Key Usage. This extensions consists of a list of usages indicating purposes for which the certificate public key can be used for, These can either be object short names of the dotted numerical form of OIDs. While any OID can be used only certain values make sense. In particular the following PKIX, NS and MS values are meaningful: Value Meaning ----- ------- serverAuth SSL/TLS Web Server Authentication. clientAuth SSL/TLS Web Client Authentication. codeSigning Code signing. emailProtection E-mail Protection (S/MIME). timeStamping Trusted Timestamping msCodeInd Microsoft Individual Code Signing (authenticode) msCodeCom Microsoft Commercial Code Signing (authenticode) msCTLSign Microsoft Trust List Signing msSGC Microsoft Server Gated Crypto msEFS Microsoft Encrypted File System nsSGC Netscape Server Gated Crypto Examples: extendedKeyUsage=critical,codeSigning,1.2.3.4 extendedKeyUsage=nsSGC,msSGC 

Answer 2

At the nut and bolt level, the openssl.cnf values ​​you used probably had some other uses, such as email. That's why they are not valid for connecting to the server that you tried to do.

Check the contents of openssl.cnf and look at the samples provided by OpenSSL sources for something that can work with a TLS web server connected to a regular web browser.