node-opcua / node-opcua-pki / 23500040793

92%

push

github

fix(ca): use `keyid` instead of `keyid:always,issuer:always`
in v3_ca section for OpenSSL 3.5.x compatibility

OpenSSL 3.5.5 (Alpine linux) strictly enforces the `always`
flag in `authorityKeyIdentifier` even during CSR generation
(`openssl req -extensions v3_ca`).  At that stage no issuer
certificate exists yet (root CA bootstrap), so the command
fails with:

  v3_akid.c:156: no issuer certificate

Using plain `keyid` (without `:always`) tells OpenSSL to
include the authority key identifier when the issuer key is
available and skip it gracefully when it is not.

The extension is properly populated during the self-signing
step (`openssl x509 -req`), so the final CA certificate
still contains the correct authorityKeyIdentifier.

The `crl_ext` section retains `keyid:always,issuer:always`
because CRL extensions are only applied when the CA cert
already exists.

Tested with:
  - OpenSSL 3.4.1  (Windows)  — works with both values
  - OpenSSL 3.5.5  (Alpine)   — requires `keyid`

Refs:
  - https://github.com/openssl/openssl/issues/21519
  - OpenSSL man x509v3_config(5) - authorityKeyIdentifier

248 of 344 branches covered (72.09%)

1173 of 1271 relevant lines covered (92.29%)

264.17 hits per line