title: Howto create a certificate using openssl including a CRL distribution point?
body: <p>I'm having problems using openssl to create a x509 certificate containing a crl distribution point for testing.</p>
  
  <p>I've checked the documentation and found the configuration setting crlDistributionPoints for this purpose. Unfortunately openssl always generates x509 version 1 certificates without instead of version 3 certificates with the crl distribution point.
  I'm sure something is wrong with my command or the configuration but reading the documentation carefully and playing around with the configuration did not help. Other settings from the configuration file are considered so I'm sure the file itself is used by openssl.</p>
  
  <p>I'm using the command</p>
  
  <pre><code>openssl x509 -req -in $NAME.csr -out certs/$NAME.pem -days 3650 -CAcreateserial -CA cacert.pem -CAkey private/cakey.pem -CAserial serial
  </code></pre>
  
  <p>I'm using the following configuration file:</p>
  
  <pre><code>[ ca ]
  default_ca              = CA_default
  
  [ CA_default ]
  
  dir                     = /home/ca
  database                = $dir/index.txt
  new_certs_dir           = $dir/newcerts
  
  certificate             = $dir/cacert.pem
  serial                  = $dir/serial
  private_key             = $dir/private/cakey.pem
  RANDFILE                = $dir/private/.rand
  
  default_days            = 3650
  default_crl_days        = 30
  default_md              = md5
  
  policy                  = policy_any
  email_in_dn             = no
  
  name_opt                = ca_default
  cert_opt                = ca_default
  copy_extensions         = none
  
  x509_extensions         = extensions_section
  
  [ extensions_section ]
  
  crlDistributionPoints=URI:http://example.com/crl.pem
  
  [ policy_any ]
  countryName             = supplied
  stateOrProvinceName     = optional
  organizationName        = optional
  organizationalUnitName  = optional
  commonName              = supplied
  emailAddress            = optional
  </code></pre>
  
  <p>Any ideas?</p>