I am using the following configuration file named root.conf:

default_bits            = 2048
default_md              = sha256
distinguished_name      = req_dn
prompt                  = no
encrypt_key             = no

CN                      = 07dda2b49637f71b6cebe87a6954e159313b4372

basicConstraints        = critical,CA:true
subjectKeyIdentifier    = hash
keyUsage                = critical,keyCertSign,cRLSign
subjectInfoAccess       = @sia
certificatePolicies     = critical,
sbgp-autonomousSysNum   = critical,@rfc3779_asns
sbgp-ipAddrBlock        = critical,@rfc3997_addrs

[sia];URI  = rsync://example.org/rpki/root/;URI = rsync://example.org/rpki/root/root.mft

AS.0 = 64496-64511
AS.1 = 65536-65551

IPv4.0 =
IPv4.1 =
IPv4.2 =
IPv6.0 = 2001:0DB8::/32

And I am using this command to create the certificate:

#!/bin/sh -    
# Generate the root key if it doesn't already exist.
test -f root.key ||
openssl genrsa -out root.key 2048

# Generate the root certificate.
openssl req                     \
-new                    \
-x509                   \
-config root.conf       \
-key    root.key        \
-out    root.cer        \
-outform    DER         \
-days       1825        \
-set_serial 1           \
-extensions x509v3_extensions

But I get the following error if I run it using the above config file:

Error Loading extension section x509v3_extensions
139978043373216:error:22097081:X509 V3 routines:DO_EXT_NCONF:unknown     extension:v3_conf.c:129:
139978043373216:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension:v3_conf.c:93:name=sbgp-autonomousSysNum, value=@rfc3779_asns

The above set of code is directly taken from http://rpki.net/wiki/doc/RPKI/CA/Configuration/CreatingRoot

  • Probably useless now, but: make sure you are using a build of OpenSSL that was configured to enable RFC3779, which is not the default. – dave_thompson_085 Sep 2 '17 at 3:11
  • Do not dare call this an answer - so I'll comment :) – Michael Felt Sep 21 '17 at 7:27
  • Do not dare call this an answer - so I'll comment :) - In order to create a self-contained self-signed certificate I used the command: "openssl req -new -x509 -nodes -set_serial 2005100101 -keyout ftpd.pem -out ftpd.pem -days 365". And that gives:"Version: 3 (0x2)". Maybe you can use that command (and "openssl x509 -in ftpd.pem -noout -text | head -5") to see if dave_thompson_085's comment is the key. (the -nodes argument prevents asking for a passphrase) (apology for duplicate - edit timeout) – Michael Felt Sep 21 '17 at 7:37

The syntax should be:

openssl x509 -new

There is no dash in front of x509

  • No, this OP does want openssl req -new -x509 and dashes on -new and -x509 as options to req are correct. x509 is a different operation, not what this OP wants although it is valid in other cases, but it does not have an option -new. – dave_thompson_085 Sep 2 '17 at 3:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.