Setting expiry for CA certificate
- Dominant language
- Go
- Stars
- 9.5k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
version: 1.2
os: Centos 7.5
Hi. I know this has probably been asked before but I can't change the 5 year default CA cert expiry no matter what I try. Here's my ca-config.json:
```
{
"signing": {
"default": {
"expiry": "143800h"
},
"profiles": {
"ca": {
"usages": [
"cert sign",
"crl sign"
],
"expiry": "143800h"
}
}
}
}
```
When I generate the ca cert the expiry is 5 years:
```
$ echo "{\"CN\":\"test\",\"key\":{\"algo\":\"rsa\",\"size\":4096},\"names\":[{\"C\":\"CA\",\"O\":\"test\",\"OU\":\"test\"}]}" | cfssl gencert -initca -config=./ca-config.json - | cfssljson -bare ca -
$ cfssl certinfo -cert ca.pem | grep not
"not_before": "2019-09-12T16:46:00Z",
"not_after": "2024-09-10T16:46:00Z",
```
How can I assign the ca cert expiry? In some of the cfssl tests I see a "ca" profile with expiry assigned, like above. Does this work? Or is it for something else?
https://github.com/cloudflare/cfssl/blob/275fb308ac705bf5631d23b941f7b56dc436e39d/signer/universal/universal_test.go
Contributor guide
Assessment
This issue has not been assessed yet.