libsec: restore old behaviour for generating self signed cert

diff --git a/sys/src/libsec/port/x509.c b/sys/src/libsec/port/x509.c
index 404d64ff3ae816f41abb260330d187ee243369ff..aaaa7fb3ee041aaee165ad5e3d4789a0fcbd9158 100644 (file)
--- a/sys/src/libsec/port/x509.c
+++ b/sys/src/libsec/port/x509.c
@@ -2658,6 +2658,10 @@ mkextensions(char *alts, int req)
                                mkel(mkoid((Ints*)&oid_extensionRequest),
                                mkel(mkset(xl), nil))), nil);
        }
+       if(req)
+               xl = mkel(mkcont(0, xl), nil);
+       else if(xl != nil)
+               xl = mkel(mkcont(3, xl), nil);
        return xl;
 }
 
@@ -2777,7 +2781,7 @@ X509rsagen(RSApriv *priv, char *subj, ulong valid[2], int *certlen)
                        mkel(mkalg(ALG_rsaEncryption),
                        mkel(mkbits(pkbytes->data, pkbytes->len),
                        nil))),
-               mkel(mkcont(3, mkextensions(alts, 0)), nil)))))))));
+               mkextensions(alts, 0)))))))));
        freebytes(pkbytes);
        if(encode(e, &certinfobytes) != ASN_OK)
                goto errret;
@@ -2843,7 +2847,7 @@ X509rsareq(RSApriv *priv, char *subj, int *certlen)
                        mkel(mkalg(ALG_rsaEncryption),
                        mkel(mkbits(pkbytes->data, pkbytes->len),
                        nil))),
-               mkel(mkcont(0, mkextensions(alts, 1)), nil)))));
+               mkextensions(alts, 1)))));
        freebytes(pkbytes);
        if(encode(e, &certinfobytes) != ASN_OK)
                goto errret;