Documentation : client-cert.conf openssl config file missing

[chriswhite199]

The documentation makes reference to client-cert.conf, and links to a script file to create client certificates suitable for jetty, but the client-cert.conf file isn't anywhere to be found in SCM:

Version 9.4.15.v20190215 of Jetty (used in the jre8 WireMock build) requires client certificates to contain Subject Alternative Names. See this script for an example of how to build a truststore containing a valid certificate (you’ll probably want to edit the client-cert.conf file before running this).

As such running the commands in the scripts/create-client-cert.sh script yields some error messages (on mac at least, not tested on unix / windows):

$ openssl version
LibreSSL 2.6.5

$ openssl req -x509 -newkey rsa:2048 -utf8 -days 3650 -nodes -config client-cert.conf -keyout client-cert.key -out client-cert.crt
error on line -1 of client-cert.conf
4480575084:error:02FFF002:system library:func(4095):No such file or directory:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.260.1/libressl-2.6/crypto/bio/bss_file.c:122:fopen('client-cert.conf', 'rb')
4480575084:error:20FFF080:BIO routines:CRYPTO_internal:no such file:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.260.1/libressl-2.6/crypto/bio/bss_file.c:125:
4480575084:error:0EFFF072:configuration file routines:CRYPTO_internal:no such file:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.260.1/libressl-2.6/crypto/conf/conf_def.c:198:

or with openssl 1.1

$ /usr/local/Cellar/openssl@1.1/1.1.1d/bin/openssl req -x509 -newkey rsa:2048 -utf8 -days 3650 -nodes -config client-cert.conf -keyout client-cert.key -out client-cert.crt
Can't open client-cert.conf for reading, No such file or directory
4493206976:error:02001002:system library:fopen:No such file or directory:crypto/bio/bss_file.c:69:fopen('client-cert.conf','r')
4493206976:error:2006D080:BIO routines:BIO_new_file:no such file:crypto/bio/bss_file.c:76:
Generating a RSA private key
..........+++++
...........+++++
writing new private key to 'client-cert.key'
-----
unable to find 'distinguished_name' in config
problems making Certificate Request
4493206976:error:0E06D06A:configuration file routines:NCONF_get_string:no conf or environment variable:crypto/conf/conf_lib.c:270:

[chriswhite199]

I should add, in either case, no crt file is created

[chriswhite199]

Here's a minimal config file that seems to work for me:

[req]
req_extensions = req_ext
distinguished_name = dn

[dn]

[req_ext]
basicConstraints = critical, CA:FALSE
keyUsage = critical, digitalSignature
extendedKeyUsage = clientAuth
subjectAltName = IP:127.0.0.1, DNS:localhost