Function md_cert_self_sign

modules/md/md_crypt.c:2014–2056

}

apr_status_t md_cert_self_sign(md_cert_t **pcert, const char *cn, 
                               apr_array_header_t *domains, md_pkey_t *pkey,
                               apr_interval_time_t valid_for, apr_pool_t *p)
{
    X509 *x;
    md_cert_t *cert = NULL;
    apr_status_t rv;
    
    assert(domains);

    if (APR_SUCCESS != (rv = mk_x509(&x, pkey, cn, valid_for, p))) goto out;
    
    /* add the domain as alt name */
    if (APR_SUCCESS != (rv = add_ext(x, NID_subject_alt_name, alt_names(domains, p), p))) {
        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: set alt_name ext", cn);
        goto out;
    }

    /* keyUsage, ExtendedKeyUsage */

    if (APR_SUCCESS != (rv = add_ext(x, NID_key_usage, "critical,digitalSignature", p))) {
        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: set keyUsage", cn);
        goto out;
    }
    if (APR_SUCCESS != (rv = add_ext(x, NID_ext_key_usage, "serverAuth", p))) {
        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: set extKeyUsage", cn);
        goto out;
    }

    /* sign with same key */
    if (!X509_sign(x, pkey->pkey, pkey_get_MD(pkey))) {
        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: sign x509", cn);
        rv = APR_EGENERAL; goto out;
    }

    cert = md_cert_make(p, x);
    rv = APR_SUCCESS;
    
out:
    *pcert = (APR_SUCCESS == rv)? cert : NULL;
    if (!cert && x) X509_free(x);
    return rv;
}

#define MD_OID_ACME_VALIDATION_NUM          "1.3.6.1.5.5.7.1.31"
#define MD_OID_ACME_VALIDATION_SNAME        "pe-acmeIdentifier"