Intermediate with OpenSSL: verify error:num=25:path length constraint exceeded about certstrap

[mcpherrinm]

The intermediate isn't actually the problem here, it's the root:

Certstrap generates roots with pathlen:0, which can't be used to sign intermediates. We don't put a pathlen on intermediates though....

That seems confusing and is definitely not documented anywhere. Path length really ought to be a flag.

[VeitSanner]

It would be really helpful, if the path length constraint is fixed. Otherwise intermediate CAs are not really working, because if the root CA is used to sign an intermediate CA. The certificates issued by the intermediate CA are invalid.

@jdtw, could you please look at PR #135.

[antong]

I ran into this same thing, but I must be missing something. How has anybody ever made use of the --intermediate functionality if the maxpathlen of the root prevents it from working at all?

[VeitSanner]

Unfortunately PR #135 is still stalled with the remark "Code owner review required".

@isemaya-square, as far as I can see you have recently merged two PRs. Is there a chance that the PR is reviewed?