From: George Thessalonikefs <george@nlnetlabs.nl>
Date: Mon, 19 Oct 2020 13:00:30 +0000 (+0200)
Subject: - Fix for attaching the X509v3 extensions to the client certificate.
X-Git-Tag: release-1.13.0rc1~32^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=50178d764aa2a0b42128e739a13a648deb4af296;p=thirdparty%2Funbound.git

- Fix for attaching the X509v3 extensions to the client certificate.
---

diff --git a/smallapp/unbound-control-setup.sh.in b/smallapp/unbound-control-setup.sh.in
index 6b5e0dbbf..eaf1d082c 100644
--- a/smallapp/unbound-control-setup.sh.in
+++ b/smallapp/unbound-control-setup.sh.in
@@ -120,6 +120,7 @@ if [ ! -f "$SVR_BASE.key" ]; then
 fi
 
 cat >server.cnf <<EOF
+[req]
 default_bits=$BITS
 default_md=$HASH
 prompt=no
@@ -189,6 +190,8 @@ if [ ! -f "$CTL_BASE.pem" -o $RECREATE -eq 1 ]; then
                   -CAkey "$SVR_BASE.key" \
                   -CAcreateserial \
                   -$HASH \
+                  -extfile client.cnf \
+                  -extensions v3_req \
                   -out "$CTL_BASE.pem"
 
     [ ! -f "CTL_BASE.pem" ] || fatal "cannot create signed client certificate"