#

[0] Fix | Delete

# OpenSSL example configuration file.

[1] Fix | Delete

# This is mostly being used for generation of certificate requests.

[2] Fix | Delete

#

[3] Fix | Delete

[4] Fix | Delete

# This definition stops the following lines choking if HOME isn't

[5] Fix | Delete

# defined.

[6] Fix | Delete

HOME = .

[7] Fix | Delete

RANDFILE = $ENV::HOME/.rnd

[8] Fix | Delete

[9] Fix | Delete

# Extra OBJECT IDENTIFIER info:

[10] Fix | Delete

#oid_file = $ENV::HOME/.oid

[11] Fix | Delete

oid_section = new_oids

[12] Fix | Delete

[13] Fix | Delete

# To use this configuration file with the "-extfile" option of the

[14] Fix | Delete

# "openssl x509" utility, name here the section containing the

[15] Fix | Delete

# X.509v3 extensions to use:

[16] Fix | Delete

# extensions =

[17] Fix | Delete

# (Alternatively, use a configuration file that has only

[18] Fix | Delete

# X.509v3 extensions in its main [= default] section.)

[19] Fix | Delete

[20] Fix | Delete

[ new_oids ]

[21] Fix | Delete

[22] Fix | Delete

# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.

[23] Fix | Delete

# Add a simple OID like this:

[24] Fix | Delete

# testoid1=1.2.3.4

[25] Fix | Delete

# Or use config file substitution like this:

[26] Fix | Delete

# testoid2=${testoid1}.5.6

[27] Fix | Delete

[28] Fix | Delete

# Policies used by the TSA examples.

[29] Fix | Delete

tsa_policy1 = 1.2.3.4.1

[30] Fix | Delete

tsa_policy2 = 1.2.3.4.5.6

[31] Fix | Delete

tsa_policy3 = 1.2.3.4.5.7

[32] Fix | Delete

[33] Fix | Delete

####################################################################

[34] Fix | Delete

[ ca ]

[35] Fix | Delete

default_ca = CA_default # The default ca section

[36] Fix | Delete

[37] Fix | Delete

####################################################################

[38] Fix | Delete

[ CA_default ]

[39] Fix | Delete

[40] Fix | Delete

dir = /etc/pki/CA # Where everything is kept

[41] Fix | Delete

certs = $dir/certs # Where the issued certs are kept

[42] Fix | Delete

crl_dir = $dir/crl # Where the issued crl are kept

[43] Fix | Delete

database = $dir/index.txt # database index file.

[44] Fix | Delete

#unique_subject = no # Set to 'no' to allow creation of

[45] Fix | Delete

# several ctificates with same subject.

[46] Fix | Delete

new_certs_dir = $dir/newcerts # default place for new certs.

[47] Fix | Delete

[48] Fix | Delete

certificate = $dir/cacert.pem # The CA certificate

[49] Fix | Delete

serial = $dir/serial # The current serial number

[50] Fix | Delete

crlnumber = $dir/crlnumber # the current crl number

[51] Fix | Delete

# must be commented out to leave a V1 CRL

[52] Fix | Delete

crl = $dir/crl.pem # The current CRL

[53] Fix | Delete

private_key = $dir/private/cakey.pem# The private key

[54] Fix | Delete

RANDFILE = $dir/private/.rand # private random number file

[55] Fix | Delete

[56] Fix | Delete

x509_extensions = usr_cert # The extentions to add to the cert

[57] Fix | Delete

[58] Fix | Delete

# Comment out the following two lines for the "traditional"

[59] Fix | Delete

# (and highly broken) format.

[60] Fix | Delete

name_opt = ca_default # Subject Name options

[61] Fix | Delete

cert_opt = ca_default # Certificate field options

[62] Fix | Delete

[63] Fix | Delete

# Extension copying option: use with caution.

[64] Fix | Delete

# copy_extensions = copy

[65] Fix | Delete

[66] Fix | Delete

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs

[67] Fix | Delete

# so this is commented out by default to leave a V1 CRL.

[68] Fix | Delete

# crlnumber must also be commented out to leave a V1 CRL.

[69] Fix | Delete

# crl_extensions = crl_ext

[70] Fix | Delete

[71] Fix | Delete

default_days = 365 # how long to certify for

[72] Fix | Delete

default_crl_days= 30 # how long before next CRL

[73] Fix | Delete

default_md = sha256 # use SHA-256 by default

[74] Fix | Delete

preserve = no # keep passed DN ordering

[75] Fix | Delete

[76] Fix | Delete

# A few difference way of specifying how similar the request should look

[77] Fix | Delete

# For type CA, the listed attributes must be the same, and the optional

[78] Fix | Delete

# and supplied fields are just that :-)

[79] Fix | Delete

policy = policy_match

[80] Fix | Delete

[81] Fix | Delete

# For the CA policy

[82] Fix | Delete

[ policy_match ]

[83] Fix | Delete

countryName = match

[84] Fix | Delete

stateOrProvinceName = match

[85] Fix | Delete

organizationName = match

[86] Fix | Delete

organizationalUnitName = optional

[87] Fix | Delete

commonName = supplied

[88] Fix | Delete

emailAddress = optional

[89] Fix | Delete

[90] Fix | Delete

# For the 'anything' policy

[91] Fix | Delete

# At this point in time, you must list all acceptable 'object'

[92] Fix | Delete

# types.

[93] Fix | Delete

[ policy_anything ]

[94] Fix | Delete

countryName = optional

[95] Fix | Delete

stateOrProvinceName = optional

[96] Fix | Delete

localityName = optional

[97] Fix | Delete

organizationName = optional

[98] Fix | Delete

organizationalUnitName = optional

[99] Fix | Delete

commonName = supplied

[100] Fix | Delete

emailAddress = optional

[101] Fix | Delete

[102] Fix | Delete

####################################################################

[103] Fix | Delete

[ req ]

[104] Fix | Delete

default_bits = 2048

[105] Fix | Delete

default_md = sha256

[106] Fix | Delete

default_keyfile = privkey.pem

[107] Fix | Delete

distinguished_name = req_distinguished_name

[108] Fix | Delete

attributes = req_attributes

[109] Fix | Delete

x509_extensions = v3_ca # The extentions to add to the self signed cert

[110] Fix | Delete

[111] Fix | Delete

# Passwords for private keys if not present they will be prompted for

[112] Fix | Delete

# input_password = secret

[113] Fix | Delete

# output_password = secret

[114] Fix | Delete

[115] Fix | Delete

# This sets a mask for permitted string types. There are several options.

[116] Fix | Delete

# default: PrintableString, T61String, BMPString.

[117] Fix | Delete

# pkix : PrintableString, BMPString (PKIX recommendation before 2004)

[118] Fix | Delete

# utf8only: only UTF8Strings (PKIX recommendation after 2004).

[119] Fix | Delete

# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).

[120] Fix | Delete

# MASK:XXXX a literal mask value.

[121] Fix | Delete

# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.

[122] Fix | Delete

string_mask = utf8only

[123] Fix | Delete

[124] Fix | Delete

# req_extensions = v3_req # The extensions to add to a certificate request

[125] Fix | Delete

[126] Fix | Delete

[ req_distinguished_name ]

[127] Fix | Delete

countryName = Country Name (2 letter code)

[128] Fix | Delete

countryName_default = XX

[129] Fix | Delete

countryName_min = 2

[130] Fix | Delete

countryName_max = 2

[131] Fix | Delete

[132] Fix | Delete

stateOrProvinceName = State or Province Name (full name)

[133] Fix | Delete

#stateOrProvinceName_default = Default Province

[134] Fix | Delete

[135] Fix | Delete

localityName = Locality Name (eg, city)

[136] Fix | Delete

localityName_default = Default City

[137] Fix | Delete

[138] Fix | Delete

0.organizationName = Organization Name (eg, company)

[139] Fix | Delete

0.organizationName_default = Default Company Ltd

[140] Fix | Delete

[141] Fix | Delete

# we can do this but it is not needed normally :-)

[142] Fix | Delete

#1.organizationName = Second Organization Name (eg, company)

[143] Fix | Delete

#1.organizationName_default = World Wide Web Pty Ltd

[144] Fix | Delete

[145] Fix | Delete

organizationalUnitName = Organizational Unit Name (eg, section)

[146] Fix | Delete

#organizationalUnitName_default =

[147] Fix | Delete

[148] Fix | Delete

commonName = Common Name (eg, your name or your server\'s hostname)

[149] Fix | Delete

commonName_max = 64

[150] Fix | Delete

[151] Fix | Delete

emailAddress = Email Address

[152] Fix | Delete

emailAddress_max = 64

[153] Fix | Delete

[154] Fix | Delete

# SET-ex3 = SET extension number 3

[155] Fix | Delete

[156] Fix | Delete

[ req_attributes ]

[157] Fix | Delete

challengePassword = A challenge password

[158] Fix | Delete

challengePassword_min = 4

[159] Fix | Delete

challengePassword_max = 20

[160] Fix | Delete

[161] Fix | Delete

unstructuredName = An optional company name

[162] Fix | Delete

[163] Fix | Delete

[ usr_cert ]

[164] Fix | Delete

[165] Fix | Delete

# These extensions are added when 'ca' signs a request.

[166] Fix | Delete

[167] Fix | Delete

# This goes against PKIX guidelines but some CAs do it and some software

[168] Fix | Delete

# requires this to avoid interpreting an end user certificate as a CA.

[169] Fix | Delete

[170] Fix | Delete

basicConstraints=CA:FALSE

[171] Fix | Delete

[172] Fix | Delete

# Here are some examples of the usage of nsCertType. If it is omitted

[173] Fix | Delete

# the certificate can be used for anything *except* object signing.

[174] Fix | Delete

[175] Fix | Delete

# This is OK for an SSL server.

[176] Fix | Delete

# nsCertType = server

[177] Fix | Delete

[178] Fix | Delete

# For an object signing certificate this would be used.

[179] Fix | Delete

# nsCertType = objsign

[180] Fix | Delete

[181] Fix | Delete

# For normal client use this is typical

[182] Fix | Delete

# nsCertType = client, email

[183] Fix | Delete

[184] Fix | Delete

# and for everything including object signing:

[185] Fix | Delete

# nsCertType = client, email, objsign

[186] Fix | Delete

[187] Fix | Delete

# This is typical in keyUsage for a client certificate.

[188] Fix | Delete

# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[189] Fix | Delete

[190] Fix | Delete

# This will be displayed in Netscape's comment listbox.

[191] Fix | Delete

nsComment = "OpenSSL Generated Certificate"

[192] Fix | Delete

[193] Fix | Delete

# PKIX recommendations harmless if included in all certificates.

[194] Fix | Delete

subjectKeyIdentifier=hash

[195] Fix | Delete

authorityKeyIdentifier=keyid,issuer

[196] Fix | Delete

[197] Fix | Delete

# This stuff is for subjectAltName and issuerAltname.

[198] Fix | Delete

# Import the email address.

[199] Fix | Delete

# subjectAltName=email:copy

[200] Fix | Delete

# An alternative to produce certificates that aren't

[201] Fix | Delete

# deprecated according to PKIX.

[202] Fix | Delete

# subjectAltName=email:move

[203] Fix | Delete

[204] Fix | Delete

# Copy subject details

[205] Fix | Delete

# issuerAltName=issuer:copy

[206] Fix | Delete

[207] Fix | Delete

#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem

[208] Fix | Delete

#nsBaseUrl

[209] Fix | Delete

#nsRevocationUrl

[210] Fix | Delete

#nsRenewalUrl

[211] Fix | Delete

#nsCaPolicyUrl

[212] Fix | Delete

#nsSslServerName

[213] Fix | Delete

[214] Fix | Delete

# This is required for TSA certificates.

[215] Fix | Delete

# extendedKeyUsage = critical,timeStamping

[216] Fix | Delete

[217] Fix | Delete

[ v3_req ]

[218] Fix | Delete

[219] Fix | Delete

# Extensions to add to a certificate request

[220] Fix | Delete

[221] Fix | Delete

basicConstraints = CA:FALSE

[222] Fix | Delete

keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[223] Fix | Delete

[224] Fix | Delete

[ v3_ca ]

[225] Fix | Delete

[226] Fix | Delete

[227] Fix | Delete

# Extensions for a typical CA

[228] Fix | Delete

[229] Fix | Delete

[230] Fix | Delete

# PKIX recommendation.

[231] Fix | Delete

[232] Fix | Delete

subjectKeyIdentifier=hash

[233] Fix | Delete

[234] Fix | Delete

authorityKeyIdentifier=keyid:always,issuer

[235] Fix | Delete

[236] Fix | Delete

# This is what PKIX recommends but some broken software chokes on critical

[237] Fix | Delete

# extensions.

[238] Fix | Delete

#basicConstraints = critical,CA:true

[239] Fix | Delete

# So we do this instead.

[240] Fix | Delete

basicConstraints = CA:true

[241] Fix | Delete

[242] Fix | Delete

# Key usage: this is typical for a CA certificate. However since it will

[243] Fix | Delete

# prevent it being used as an test self-signed certificate it is best

[244] Fix | Delete

# left out by default.

[245] Fix | Delete

# keyUsage = cRLSign, keyCertSign

[246] Fix | Delete

[247] Fix | Delete

# Some might want this also

[248] Fix | Delete

# nsCertType = sslCA, emailCA

[249] Fix | Delete

[250] Fix | Delete

# Include email address in subject alt name: another PKIX recommendation

[251] Fix | Delete

# subjectAltName=email:copy

[252] Fix | Delete

# Copy issuer details

[253] Fix | Delete

# issuerAltName=issuer:copy

[254] Fix | Delete

[255] Fix | Delete

# DER hex encoding of an extension: beware experts only!

[256] Fix | Delete

# obj=DER:02:03

[257] Fix | Delete

# Where 'obj' is a standard or added object

[258] Fix | Delete

# You can even override a supported extension:

[259] Fix | Delete

# basicConstraints= critical, DER:30:03:01:01:FF

[260] Fix | Delete

[261] Fix | Delete

[ crl_ext ]

[262] Fix | Delete

[263] Fix | Delete

# CRL extensions.

[264] Fix | Delete

# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

[265] Fix | Delete

[266] Fix | Delete

# issuerAltName=issuer:copy

[267] Fix | Delete

authorityKeyIdentifier=keyid:always

[268] Fix | Delete

[269] Fix | Delete

[ proxy_cert_ext ]

[270] Fix | Delete

# These extensions should be added when creating a proxy certificate

[271] Fix | Delete

[272] Fix | Delete

# This goes against PKIX guidelines but some CAs do it and some software

[273] Fix | Delete

# requires this to avoid interpreting an end user certificate as a CA.

[274] Fix | Delete

[275] Fix | Delete

basicConstraints=CA:FALSE

[276] Fix | Delete

[277] Fix | Delete

# Here are some examples of the usage of nsCertType. If it is omitted

[278] Fix | Delete

# the certificate can be used for anything *except* object signing.

[279] Fix | Delete

[280] Fix | Delete

# This is OK for an SSL server.

[281] Fix | Delete

# nsCertType = server

[282] Fix | Delete

[283] Fix | Delete

# For an object signing certificate this would be used.

[284] Fix | Delete

# nsCertType = objsign

[285] Fix | Delete

[286] Fix | Delete

# For normal client use this is typical

[287] Fix | Delete

# nsCertType = client, email

[288] Fix | Delete

[289] Fix | Delete

# and for everything including object signing:

[290] Fix | Delete

# nsCertType = client, email, objsign

[291] Fix | Delete

[292] Fix | Delete

# This is typical in keyUsage for a client certificate.

[293] Fix | Delete

# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[294] Fix | Delete

[295] Fix | Delete

# This will be displayed in Netscape's comment listbox.

[296] Fix | Delete

nsComment = "OpenSSL Generated Certificate"

[297] Fix | Delete

[298] Fix | Delete

# PKIX recommendations harmless if included in all certificates.

[299] Fix | Delete

subjectKeyIdentifier=hash

[300] Fix | Delete

authorityKeyIdentifier=keyid,issuer

[301] Fix | Delete

[302] Fix | Delete

# This stuff is for subjectAltName and issuerAltname.

[303] Fix | Delete

# Import the email address.

[304] Fix | Delete

# subjectAltName=email:copy

[305] Fix | Delete

# An alternative to produce certificates that aren't

[306] Fix | Delete

# deprecated according to PKIX.

[307] Fix | Delete

# subjectAltName=email:move

[308] Fix | Delete

[309] Fix | Delete

# Copy subject details

[310] Fix | Delete

# issuerAltName=issuer:copy

[311] Fix | Delete

[312] Fix | Delete

#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem

[313] Fix | Delete

#nsBaseUrl

[314] Fix | Delete

#nsRevocationUrl

[315] Fix | Delete

#nsRenewalUrl

[316] Fix | Delete

#nsCaPolicyUrl

[317] Fix | Delete

#nsSslServerName

[318] Fix | Delete

[319] Fix | Delete

# This really needs to be in place for it to be a proxy certificate.

[320] Fix | Delete

proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

[321] Fix | Delete

[322] Fix | Delete

####################################################################

[323] Fix | Delete

[ tsa ]

[324] Fix | Delete

[325] Fix | Delete

default_tsa = tsa_config1 # the default TSA section

[326] Fix | Delete

[327] Fix | Delete

[ tsa_config1 ]

[328] Fix | Delete

[329] Fix | Delete

# These are used by the TSA reply generation only.

[330] Fix | Delete

dir = ./demoCA # TSA root directory

[331] Fix | Delete

serial = $dir/tsaserial # The current serial number (mandatory)

[332] Fix | Delete

crypto_device = builtin # OpenSSL engine to use for signing

[333] Fix | Delete

signer_cert = $dir/tsacert.pem # The TSA signing certificate

[334] Fix | Delete

# (optional)

[335] Fix | Delete

certs = $dir/cacert.pem # Certificate chain to include in reply

[336] Fix | Delete

# (optional)

[337] Fix | Delete

signer_key = $dir/private/tsakey.pem # The TSA private key (optional)

[338] Fix | Delete

[339] Fix | Delete

default_policy = tsa_policy1 # Policy if request did not specify it

[340] Fix | Delete

# (optional)

[341] Fix | Delete

other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)

[342] Fix | Delete

digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory)

[343] Fix | Delete

accuracy = secs:1, millisecs:500, microsecs:100 # (optional)

[344] Fix | Delete

clock_precision_digits = 0 # number of digits after dot. (optional)

[345] Fix | Delete

ordering = yes # Is ordering defined for timestamps?

[346] Fix | Delete

# (optional, default: no)

[347] Fix | Delete

tsa_name = yes # Must the TSA name be included in the reply?

[348] Fix | Delete

# (optional, default: no)

[349] Fix | Delete

ess_cert_id_chain = no # Must the ESS cert id chain be included?

[350] Fix | Delete

# (optional, default: no)

[351] Fix | Delete

[352] Fix | Delete