Added a comment pointing out the behaviour of "openssl x509 -conf ...",

which cost me some time to find out about.

diff --git a/apps/openssl.cnf b/apps/openssl.cnf
index ac442a732b0cf64a43ed598199e2b31bf5a5d035..5ecc21571ac3df884430b36c9848f7c16b956e6d 100644 (file)
--- a/apps/openssl.cnf
+++ b/apps/openssl.cnf
@@ -7,6 +7,13 @@ RANDFILE               = $ENV::HOME/.rnd
 oid_file               = $ENV::HOME/.oid
 oid_section            = new_oids
 
+# To use this configuration file with the "-config" option of the
+# "openssl x509" utility, name here the section containing the
+# X.509v3 extensions to use:
+# extensions           = 
+# (Alternatively, use a configuration file that has only
+# X.509v3 extensions in its main [= default] section.)
+
 [ new_oids ]
 
 # We can add new OIDs in here for use by 'ca' and 'req'.