NetBSD Problem Report #60365

From www@netbsd.org  Thu Jun 25 00:58:49 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "R13" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 9AEB61A923A
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 25 Jun 2026 00:58:49 +0000 (UTC)
Message-Id: <20260625005848.7D0F11A923B@mollari.NetBSD.org>
Date: Thu, 25 Jun 2026 00:58:48 +0000 (UTC)
From: matt@librequest.org
Reply-To: matt@librequest.org
To: gnats-bugs@NetBSD.org
Subject: LibreSSL/OpenSSL req missing config file
X-Send-Pr-Version: www-1.0
X-From4GNATS: "matt@librequest.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60365
>Notify-List:    riastradh@NetBSD.org
>Category:       port-amd64
>Synopsis:       LibreSSL/OpenSSL req missing config file
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    port-amd64-maintainer
>State:          analyzed
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Thu Jun 25 01:00:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Thu Jun 25 21:00:02 +0000 2026
>Originator:     LibreQuest
>Release:        NetBSD 11 RC5 / NetBSD 10
>Organization:
n/a
>Environment:
NetBSD -----.-----.--- 11.0_RC5 NetBSD 11.0_RC5 (GENERIC) #0: Tue Jun 16 15:48:07 UTC 2026  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64

>Description:
Warning: Will read cert request from stdin since no -in option is given
Can't open "/etc/openssl/openssl.cnf" for reading, No such file or directory
FFFFFFFFFFFFFFFF:error:80000002:system library:BIO_new_file:No such file or directory:/usr/src/crypto/external/apache2/openssl/dist/crypto/bio/bss_file.c:67:calling fopen(/etc/openssl/openssl.cnf, r)
FFFFFFFFFFFFFFFF:error:10000080:BIO routines:BIO_new_file:no such file:/usr/src/crypto/external/apache2/openssl/dist/crypto/bio/bss_file.c:75:
>How-To-Repeat:
Using OpenSSL or LibreSSL - running command "openssl req" 
>Fix:
Comment from user rvp on UnitedBSD.com 

"There's a default config. file in /usr/share/examples/openssl/ which you can copy into /etc/openssl/."

>Release-Note:

>Audit-Trail:

State-Changed-From-To: open->analyzed
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Thu, 25 Jun 2026 01:20:24 +0000
State-Changed-Why:
I have mixed feelings about this.

On the one hand, it is nice to make a command line such as

openssl req -new -sha256 -key key -subj / -addext subjectAltName=DNS:example.com

like you'll find at <https://github.com/diafygi/acme-tiny> work out of
the box.  And since netbsd-10, openssl is happy with an empty
openssl.cnf to make this happen.  (In netbsd<=9, openssl required some
stuff in the config file, like a [req]distinguished_name setting
pointing to a section that provides various DN parameters.)

On the other hand, other systems like Debian ship what is really an
_example_ at /etc/ssl/openssl.cnf rather than a set of reasonable
_defaults_, so if you do try to use `openssl req' without your own
complete config file replacement, your certificate request will include
things like countryName=AU and ON=Internet Widgits Pty Ltd.  In other
words, you really _don't_ want to use the default shipped on other
systems.  And you can safely just use `-config /dev/null', which is the
portable way to do it.  In other words, by making this work on NetBSD,
we're encouraging foot-guns on other systems.

So I'm tempted to create an empty /etc/openssl/openssl.cnf (except for
some comments).  I'm not 100% convinced it's the right thing.  But it's
probably reasonable to do.

I have not looked into what other openssl commands require a config
file.  Maybe it would be better to just patch `openssl req' so that it
doesn't fail if the config file doesn't exist, since surely that's not
much different from having an empty config file.


From: matt@librequest.org
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: port-amd64/60365 (LibreSSL/OpenSSL req missing config file)
Date: Thu, 25 Jun 2026 08:14:34 -0400

 Perhaps a good option would be to leave the error but include a pointer 
 to the config example file in the error output.

From: matt@librequest.org
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: port-amd64/60365 (LibreSSL/OpenSSL req missing config file)
Date: Thu, 25 Jun 2026 16:58:24 -0400

 Note: I tried sending config to dev null which produces an error as well 
 as an empty config produces an error.

>Unformatted:

Home	PR Database Search