Don't always use issuer serial version of AKID.

diff --git a/apps/openssl.cnf b/apps/openssl.cnf
index 04710f87d57785d714a49e7305a9ba383defc10e..9e59020c17643dd7988246a067ec8a5e75bd6170 100644 (file)
--- a/apps/openssl.cnf
+++ b/apps/openssl.cnf
@@ -188,7 +188,7 @@ nsComment                   = "OpenSSL Generated Certificate"
 
 # PKIX recommendations harmless if included in all certificates.
 subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer:always
+authorityKeyIdentifier=keyid,issuer
 
 # This stuff is for subjectAltName and issuerAltname.
 # Import the email address.