cloudflare / cloudflare/cfssl

Setting expiry for CA certificate

Open
#1,034 7 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
9.5k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

version: 1.2
os: Centos 7.5

Hi. I know this has probably been asked before but I can't change the 5 year default CA cert expiry no matter what I try. Here's my ca-config.json:
```
{
"signing": {
"default": {
"expiry": "143800h"
},
"profiles": {
"ca": {
"usages": [
"cert sign",
"crl sign"
],
"expiry": "143800h"
}
}
}
}
```
When I generate the ca cert the expiry is 5 years:
```
$ echo "{\"CN\":\"test\",\"key\":{\"algo\":\"rsa\",\"size\":4096},\"names\":[{\"C\":\"CA\",\"O\":\"test\",\"OU\":\"test\"}]}" | cfssl gencert -initca -config=./ca-config.json - | cfssljson -bare ca -
$ cfssl certinfo -cert ca.pem | grep not
"not_before": "2019-09-12T16:46:00Z",
"not_after": "2024-09-10T16:46:00Z",
```
How can I assign the ca cert expiry? In some of the cfssl tests I see a "ca" profile with expiry assigned, like above. Does this work? Or is it for something else?

https://github.com/cloudflare/cfssl/blob/275fb308ac705bf5631d23b941f7b56dc436e39d/signer/universal/universal_test.go

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.