Fixed issue in CA cert. creation

eclipse-mosquitto · Jan 15, 2025 · 76dc96c · 76dc96c
1 parent 849e0f5
commit 76dc96c
Showing 1 changed file with 2 additions and 4 deletions.
diff --git a/test/ssl/openssl.cnf b/test/ssl/openssl.cnf
@@ -291,14 +291,12 @@ authorityKeyIdentifier=keyid:always,issuer
 
 # This is what PKIX recommends but some broken software chokes on critical
 # extensions.
-#basicConstraints = critical,CA:true
-# So we do this instead.
-basicConstraints = CA:true
+basicConstraints = critical,CA:true
 
 # Key usage: this is typical for a CA certificate. However since it will
 # prevent it being used as an test self-signed certificate it is best
 # left out by default.
-# keyUsage = cRLSign, keyCertSign
+keyUsage = cRLSign, keyCertSign
 
 # Some might want this also
 # nsCertType = sslCA, emailCA