title: 'Certificate must have an ExtendedKeyUsage extension.' and 'Error Loading extension section config.cnf'
body: <p>Using Bouncy Castle to generate timestamps. I originally created the certificate using</p>
  
  <p><code>sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout private.key -out cert.crt</code> but got the error <code>Certificate must have an ExtendedKeyUsage extension.</code>.</p>
  
  <p>So following the instructions <a href="https://stackoverflow.com/questions/13332694/create-tsa-timestamping-certificate-with-openssl-add-a-extendedkeyusage-in-a">here</a> and adding a config file, I got the error <code>unable to find 'distinguished_name' in config - problems making Certificate Request</code></p>
  
  <p>I tried the instructions <a href="https://superuser.com/questions/947061/openssl-unable-to-find-distinguished-name-in-config">here</a>, but then got the error <code>Error Loading extension section req</code>.</p>
  
  <p>The simplest config I've used is this, but I've also tried others which including the organization such as a modified version of <a href="https://github.com/openssl/openssl/blob/master/apps/openssl.cnf" rel="nofollow noreferrer">this one</a>, but no luck.</p>
  
  <pre><code>[req]
  distinguished_name = req_distinguished_name
  </code></pre>
  
  <p>The commands I've tried:</p>
  
  <pre><code>sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout private.key -out cert.crt -config config.cnf
  
  sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout private.key -out cert.crt -extensions req
  
  sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout private.key -out cert.crt -config config.cnf -extensions req
  </code></pre>
  
  <p>some posts reference an <code>-ext-file</code> switch, but this is not available.</p>