Set authorityKeyIdentifier=keyid if Authority Key Identifier is set in the UI

[sebschrader]

Set authorityKeyIdentifier=keyid if Authority Key Identifier is set in the UI

[chris2511]

Hi Sebastian,

this has already been changed for XCA 1.4.1 with commit e3c9d7b
The pre-version 1.4.1-pre02 containing this change is available at https://hohnstaedt.de/downloads/
If you also think this is what you asked for (and probably checked with 1.4.1-pre02) please close this issue.

[sebschrader]

Hi Christian,

thank you very much for your fast response. I just checked a local build of 1.4.1-pre02 and it worked as expected.

Just for the record: My previous statement was not entirely correct. As can be seen from the commit you referenced, XCA used to set authorityKeyIdentifier=keyid:always,issuer:always. I updated my initial comment accordingly.

OpenSSL just ignore issuer, if not suffixed with always, to comply with PKIX recommendations and CA guidelines. Is there any reason, why you left issuer in there and not set authorityKeyIdentifier=keyid?

[sebschrader]

Keeping issuer is for cases, where the CA doesn't have a Subject Key Identifier. Closing.