Creating Client and Server Certificates issue

[ptkien90]

Hi all, I am facing an issue when creating Client and Server Certificates on the jump box. When executing the command below, I receive the following message. I am using OpenSSL version 1.1.1f 31 Mar 2020. It only creates the *.key file, without generating the *.crt and *.csr files. What should I do to address this issue? When I tried to remove -section ${i} and -copy_extensions copyall, it worked fine.

root@jumpbox:~/kubernetes-the-hard-way# for i in ${certs[*]}; do

openssl genrsa -out "${i}.key" 4096

openssl req -new -key "${i}.key" -sha256
-config "ca.conf" -section ${i}
-out "${i}.csr"

openssl x509 -req -days 3653 -in "${i}.csr"
-copy_extensions copyall
-sha256 -CA "ca.crt"
-CAkey "ca.key"
-CAcreateserial
-out "${i}.crt"
done
Generating RSA private key, 4096 bit long modulus (2 primes)
.++++
...............................................................................................................................................................................................................................................................................................++++
e is 65537 (0x010001)
req: Unrecognized flag section
req: Use -help for summary.
x509: Unrecognized flag copy_extensions
x509: Use -help for summary.
Generating RSA private key, 4096 bit long modulus (2 primes)
...............................................................++++
...............................++++
e is 65537 (0x010001)
req: Unrecognized flag section
req: Use -help for summary.
x509: Unrecognized flag copy_extensions
x509: Use -help for summary.
Generating RSA private key, 4096 bit long modulus (2 primes)
......................................................................................................................................................................................................................................++++
.........................................................++++
e is 65537 (0x010001)
req: Unrecognized flag section
req: Use -help for summary.
x509: Unrecognized flag copy_extensions
x509: Use -help for summary.
Generating RSA private key, 4096 bit long modulus (2 primes)
............................................................................++++
....++++
e is 65537 (0x010001)
req: Unrecognized flag section
req: Use -help for summary.
x509: Unrecognized flag copy_extensions
x509: Use -help for summary.
Generating RSA private key, 4096 bit long modulus (2 primes)
..............................................................................................++++
....................++++
e is 65537 (0x010001)
req: Unrecognized flag section
req: Use -help for summary.
x509: Unrecognized flag copy_extensions
x509: Use -help for summary.
Generating RSA private key, 4096 bit long modulus (2 primes)
......................................................++++
.....................................................++++
e is 65537 (0x010001)
req: Unrecognized flag section
req: Use -help for summary.
x509: Unrecognized flag copy_extensions
x509: Use -help for summary.
Generating RSA private key, 4096 bit long modulus (2 primes)
......................................................................++++
..............................................................................................................................................................................................................................++++
e is 65537 (0x010001)
req: Unrecognized flag section
req: Use -help for summary.
x509: Unrecognized flag copy_extensions
x509: Use -help for summary.
Generating RSA private key, 4096 bit long modulus (2 primes)
..............................................++++
......................................................................++++
e is 65537 (0x010001)
req: Unrecognized flag section
req: Use -help for summary.
x509: Unrecognized flag copy_extensions
x509: Use -help for summary.

[joey-grant]

I am using OpenSSL version 1.1.1f 31 Mar 2020

Hello there! It looks like you need to bump up to OpenSSL 3. Debian Bookworm, the OS listed as a requirement for this repo's labs, ships with OpenSSL 3.

Hope this helps!