title: Creating self-signed certificate using pyopenssl
body: <p>I am trying to generate ac self signed X509v3 CA certificate using pyopenssl.
  I would want to add the extension authority key identifier (AKID) with keyid containing subject key identifier (SKID).</p>
  
  <p>But my following code block does not copy the SKID to AKID rather throws an exception.</p>
  
  <p>The code is as follows</p>
  
  <pre><code>import OpenSSL
  
  key = OpenSSL.crypto.PKey()
  key.generate_key(OpenSSL.crypto.TYPE_RSA, 2048)
  
  ca = OpenSSL.crypto.X509()
  ca.set_version(2)
  ca.set_serial_number(1)
  ca.get_subject().CN = "ca.example.com"
  ca.gmtime_adj_notBefore(0)
  ca.gmtime_adj_notAfter(24 * 60 * 60)
  ca.set_issuer(ca.get_subject())
  ca.set_pubkey(key)
  ca.add_extensions([
    OpenSSL.crypto.X509Extension("basicConstraints", True,
                                 "CA:TRUE, pathlen:0"),
    OpenSSL.crypto.X509Extension("keyUsage", True,
                                 "keyCertSign, cRLSign"),
    OpenSSL.crypto.X509Extension("subjectKeyIdentifier", False, "hash",
                                 subject=ca),
    OpenSSL.crypto.X509Extension("authorityKeyIdentifier", False, "keyid:always",issuer=ca)
    ])
  ca.sign(key, "sha1")
  open("MyCertificate.crt.bin", "wb").write(
              OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_ASN1, ca))
  </code></pre>
  
  <p>the Exception thrown is as follows</p>
  
  <pre><code>Traceback (most recent call last):
    File "C:\Documents and Settings\Administrator\Desktop\Certificate\certi.py", line 21, in &lt;module&gt;
      OpenSSL.crypto.X509Extension("authorityKeyIdentifier", False, "keyid:always",issuer=ca)
  Error: [('X509 V3 routines', 'V2I_AUTHORITY_KEYID', 'unable to get issuer keyid'), ('X509 V3 routines', 'X509V3_EXT_nconf', 'error in extension')]
  </code></pre>
  
  <p>Now if I remove "<strong>always</strong>" from the line keyid parameter in the below line of the code</p>
  
  <blockquote>
    <p>OpenSSL.crypto.X509Extension("authorityKeyIdentifier", False,
    "keyid",issuer=ca)</p>
  </blockquote>
  
  <p>i get the AKID keyid field to be empty and it does not contain the SKID as shown below</p>
  
  <pre><code>          00:84:13:70:73:fe:29:61:5f:33:7d:b3:74:97:3b:
              3a:f3:11:01:7c:b8:37:a8:8c:72:81:ee:92:fd:91:
              8a:11:b3:b3:02:b4:97:d5:f8:1b:91:54:7e:15:49:
              26:6d
          Exponent: 65537 (0x10001)
  X509v3 extensions:
      X509v3 Basic Constraints: critical
          CA:TRUE, pathlen:0
      X509v3 Key Usage: critical
          Certificate Sign, CRL Sign
      X509v3 Subject Key Identifier: 
          CE:D1:31:DE:CF:E3:E2:BC:6C:73:3D:55:F0:88:53:0A:F1:DC:31:14
      X509v3 Authority Key Identifier: 
          0.
  Signature Algorithm: sha1WithRSAEncryption
       0b:7b:28:f6:b9:1e:6e:ec:53:6a:c5:77:db:c5:3f:5e:1d:ab:
       e5:43:73:eb:52:24:af:39:2b:aa:a3:f6:34:e1:92:4b:3b:5e:
       b6:1
  </code></pre>