1 # |
|
2 # OpenSSL example configuration file. |
|
3 # This is mostly being used for generation of certificate requests. |
|
4 # |
|
5 |
|
6 # This definition stops the following lines choking if HOME isn't |
|
7 # defined. |
|
8 #HOME = . |
|
9 #RANDFILE = $ENV::HOME/.rnd |
|
10 |
|
11 # Extra OBJECT IDENTIFIER info: |
|
12 #oid_file = $ENV::HOME/.oid |
|
13 #oid_section = new_oids |
|
14 |
|
15 |
|
16 #################################################################### |
|
17 [ ca ] |
|
18 default_ca = CA_default # The default ca section |
|
19 |
|
20 #################################################################### |
|
21 [ CA_default ] |
|
22 |
|
23 [% IF not cadir %] |
|
24 [% THROW param "missing ca dir" %] |
|
25 [% END %] |
|
26 |
|
27 dir = [% cadir %] |
|
28 certs = $dir/certs # Where the issued certs are kept |
|
29 crl_dir = $dir/crl # Where the issued crl are kept |
|
30 database = $dir/index # database index file. |
|
31 #unique_subject = no # Set to 'no' to allow creation of |
|
32 # several ctificates with same subject. |
|
33 new_certs_dir = $dir/newcerts # default place for new certs. |
|
34 |
|
35 [% IF not cacrt %] |
|
36 [% THROW param "missing ca crt" %] |
|
37 [% END %] |
|
38 |
|
39 certificate = [% cacrt %] # The CA certificate |
|
40 serial = $dir/serial # The current serial number |
|
41 crlnumber = $dir/crlnumber # the current crl number |
|
42 # must be commented out to leave a V1 CRL |
|
43 crl = $dir/crl.pem # The current CRL |
|
44 |
|
45 [% IF not cakey %] |
|
46 [% THROW param "missing ca key" %] |
|
47 [% END %] |
|
48 |
|
49 private_key = [% cakey %] # The private key |
|
50 |
|
51 RANDFILE = $dir/.rand # private random number file |
|
52 |
|
53 x509_extensions = usr_cert # The extentions to add to the cert |
|
54 |
|
55 # Comment out the following two lines for the "traditional" |
|
56 # (and highly broken) format. |
|
57 name_opt = ca_default # Subject Name options |
|
58 cert_opt = ca_default # Certificate field options |
|
59 |
|
60 # Extension copying option: use with caution. |
|
61 # copy_extensions = copy |
|
62 |
|
63 # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs |
|
64 # so this is commented out by default to leave a V1 CRL. |
|
65 # crlnumber must also be commented out to leave a V1 CRL. |
|
66 # crl_extensions = crl_ext |
|
67 |
|
68 [% DEFAULT days = 365 %] |
|
69 default_days = [% days %] # how long to certify for |
|
70 default_crl_days= 30 # how long before next CRL |
|
71 default_md = sha1 # which md to use. |
|
72 preserve = no # keep passed DN ordering |
|
73 |
|
74 # A few difference way of specifying how similar the request should look |
|
75 # For type CA, the listed attributes must be the same, and the optional |
|
76 # and supplied fields are just that :-) |
|
77 [% DEFAULT policy = de %] |
|
78 policy = [% policy %] |
|
79 |
|
80 # For the CA policy |
|
81 [ policy_de ] |
|
82 countryName = match |
|
83 stateOrProvinceName = supplied |
|
84 organizationName = supplied |
|
85 organizationalUnitName = optional |
|
86 commonName = supplied |
|
87 emailAddress = optional |
|
88 |
|
89 # For the 'anything' policy |
|
90 # At this point in time, you must list all acceptable 'object' |
|
91 # types. |
|
92 [ policy_anything ] |
|
93 countryName = optional |
|
94 stateOrProvinceName = optional |
|
95 localityName = optional |
|
96 organizationName = optional |
|
97 organizationalUnitName = optional |
|
98 commonName = supplied |
|
99 emailAddress = optional |
|
100 |
|
101 #################################################################### |
|
102 |
|
103 [ usr_cert ] |
|
104 |
|
105 # These extensions are added when 'ca' signs a request. |
|
106 |
|
107 # This goes against PKIX guidelines but some CAs do it and some software |
|
108 # requires this to avoid interpreting an end user certificate as a CA. |
|
109 |
|
110 basicConstraints=CA:FALSE |
|
111 |
|
112 # Here are some examples of the usage of nsCertType. If it is omitted |
|
113 # the certificate can be used for anything *except* object signing. |
|
114 |
|
115 [% IF type %] |
|
116 # This is OK for an SSL server. |
|
117 nsCertType = [% type %] |
|
118 [% END %] |
|
119 |
|
120 # This will be displayed in Netscape's comment listbox. |
|
121 nsComment = "OpenSSL Generated Certificate" |
|
122 |
|
123 # PKIX recommendations harmless if included in all certificates. |
|
124 subjectKeyIdentifier=hash |
|
125 authorityKeyIdentifier=keyid,issuer |
|
126 |
|
127 nsCaRevocationUrl = https://ssl.schlittermann.de/ca/ca-crl.pem |
|
128 nsRevocationUrl = https://ssl.schlittermann.de/ca/crt-crl.pem |
|