OpenSSL：第一个 num 太大 - 这是什么意思以及如何修复它？答案

【问题标题】：OpenSSL: first num too large - what does it mean and how to have it fixed?OpenSSL：第一个 num 太大 - 这是什么意思以及如何修复它？
【发布时间】：2021-01-09 23:56:49
【问题描述】：

这是我生成证书的命令

 root@porteus:/mnt/sda1/porteus/base# openssl version 
 OpenSSL 1.0.2o 27 Mar 2018
 root@porteus:/mnt/sda1/porteus/base# openssl req -new -out wso2.csr -newkey rsa:2048 -nodes  -sha256 -keyout wso2.key -config /tmp/req.conf

 Error Loading extension section v3_req 2828282292:error:0D06407A:asn1 encoding routines:a2d_ASN1_OBJECT:first num too large:a_object.c:108: 2828282292:error:2206706E:X509 V3
 routines:V2I_EXTENDED_KEY_USAGE:invalid object identifier:v3_extku.c:142:section:,name:clientAtuth,value: 2828282292:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension:v3_conf.c:95:name=extendedKeyUsage, value=serverAuth, clientAtuth

这是 /tmp/req.conf

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = RU
ST = Moscow
L = Moscow
O = "Credit Swiss"
OU = IT
CN = wso2.endocs.ru
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAtuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = wso2.endocs.ru

它想要什么以及如何解决问题？

【问题讨论】：

您在“clientAuth”中有拼写错误。也许与此有关？
@MattCaswell 我认为你击中了靶心，错误消息指示相同的 routines:X509V3_EXT_nconf:error in extension:v3_conf.c:95:name=extendedKeyUsage, value=serverAuth, clientAtuth

标签： openssl self-signed-certificate

【解决方案1】：

正如上面@MattCaswell 所指出的，

cat openssl.cnf | grep extendedKeyUsage
extendedKeyUsage = serverAuth, clientAtuth

openssl req -new -out wso2.csr -newkey rsa:2048 -nodes  -sha256 -keyout wso2.key -config openssl.cnf

Error Loading request extension section v3_req
140460060510096:error:0D06407A:asn1 encoding routines:a2d_ASN1_OBJECT:first num too large:a_object.c:108:
140460060510096:error:2206706E:X509 V3 routines:V2I_EXTENDED_KEY_USAGE:invalid object identifier:v3_extku.c:142:section:,name:clientAtuth,value:
140460060510096:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension:v3_conf.c:95:name=extendedKeyUsage, value=serverAuth, clientAtuth

改错后：

 cat openssl.cnf | grep extendedKeyUsage
extendedKeyUsage = serverAuth, clientAuth


 openssl req -new -out wso2.csr -newkey rsa:2048 -nodes  -sha256 -keyout wso2.key -config openssl.cnf
Generating a 2048 bit RSA private key
.......................................+++
............................+++
writing new private key to 'wso2.key'
-----

【讨论】：