Don't add the TS EKU by default in openssl.cnf because it then

makes certificates genereated by ca, CA.pl etc useless for anything else.

diff --git a/apps/openssl.cnf b/apps/openssl.cnf
index 2995800d96565247b86ec820c8d59dcac9106b86..7bcaa53ede5faa99fe77d2a0e737ce4ac51616a4 100644 (file)
--- a/apps/openssl.cnf
+++ b/apps/openssl.cnf
@@ -212,7 +212,7 @@ authorityKeyIdentifier=keyid,issuer
 #nsSslServerName
 
 # This is required for TSA certificates.
-extendedKeyUsage = critical,timeStamping
+# extendedKeyUsage = critical,timeStamping
 
 [ v3_req ]