when i try to build a CA,

if i use :

openssl x509 -req -extensions v3_ca -sha256 -days 7300 -in toto.csr -signkey toto.key -out toto.crt

openssl will not use the section v3_ca, and will happily output a wrongly generated cert.
and worse of all, not say anything about the not used section.

the right command was :

openssl x509 -req -extfile /etc/ssl/openssl.cnf -extensions v3_ca -sha256 -days 7300 -in toto.csr -signkey toto.key -out toto.crt

in the x509 manpage, in the -extfile section, it is specified that -extfile is mandatory.

however, I think that it should be told also in the -extensions section.

and more than that, it should print a warning "not using extension XXX, extfile not here"

thanks