#

[0] Fix | Delete

# OpenSSL example configuration file.

[1] Fix | Delete

# This is mostly being used for generation of certificate requests.

[2] Fix | Delete

#

[3] Fix | Delete

[4] Fix | Delete

# Note that you can include other files from the main configuration

[5] Fix | Delete

# file using the .include directive.

[6] Fix | Delete

#.include filename

[7] Fix | Delete

[8] Fix | Delete

# This definition stops the following lines choking if HOME isn't

[9] Fix | Delete

# defined.

[10] Fix | Delete

HOME = .

[11] Fix | Delete

[12] Fix | Delete

# Extra OBJECT IDENTIFIER info:

[13] Fix | Delete

#oid_file = $ENV::HOME/.oid

[14] Fix | Delete

oid_section = new_oids

[15] Fix | Delete

[16] Fix | Delete

# To use this configuration file with the "-extfile" option of the

[17] Fix | Delete

# "openssl x509" utility, name here the section containing the

[18] Fix | Delete

# X.509v3 extensions to use:

[19] Fix | Delete

# extensions =

[20] Fix | Delete

# (Alternatively, use a configuration file that has only

[21] Fix | Delete

# X.509v3 extensions in its main [= default] section.)

[22] Fix | Delete

[23] Fix | Delete

# Load default TLS policy configuration

[24] Fix | Delete

[25] Fix | Delete

openssl_conf = default_modules

[26] Fix | Delete

[27] Fix | Delete

[ default_modules ]

[28] Fix | Delete

[29] Fix | Delete

ssl_conf = ssl_module

[30] Fix | Delete

[31] Fix | Delete

[ ssl_module ]

[32] Fix | Delete

[33] Fix | Delete

system_default = crypto_policy

[34] Fix | Delete

[35] Fix | Delete

[ crypto_policy ]

[36] Fix | Delete

[37] Fix | Delete

.include /etc/crypto-policies/back-ends/opensslcnf.config

[38] Fix | Delete

[39] Fix | Delete

[ new_oids ]

[40] Fix | Delete

[41] Fix | Delete

# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.

[42] Fix | Delete

# Add a simple OID like this:

[43] Fix | Delete

# testoid1=1.2.3.4

[44] Fix | Delete

# Or use config file substitution like this:

[45] Fix | Delete

# testoid2=${testoid1}.5.6

[46] Fix | Delete

[47] Fix | Delete

# Policies used by the TSA examples.

[48] Fix | Delete

tsa_policy1 = 1.2.3.4.1

[49] Fix | Delete

tsa_policy2 = 1.2.3.4.5.6

[50] Fix | Delete

tsa_policy3 = 1.2.3.4.5.7

[51] Fix | Delete

[52] Fix | Delete

####################################################################

[53] Fix | Delete

[ ca ]

[54] Fix | Delete

default_ca = CA_default # The default ca section

[55] Fix | Delete

[56] Fix | Delete

####################################################################

[57] Fix | Delete

[ CA_default ]

[58] Fix | Delete

[59] Fix | Delete

dir = /etc/pki/CA # Where everything is kept

[60] Fix | Delete

certs = $dir/certs # Where the issued certs are kept

[61] Fix | Delete

crl_dir = $dir/crl # Where the issued crl are kept

[62] Fix | Delete

database = $dir/index.txt # database index file.

[63] Fix | Delete

#unique_subject = no # Set to 'no' to allow creation of

[64] Fix | Delete

# several certs with same subject.

[65] Fix | Delete

new_certs_dir = $dir/newcerts # default place for new certs.

[66] Fix | Delete

[67] Fix | Delete

certificate = $dir/cacert.pem # The CA certificate

[68] Fix | Delete

serial = $dir/serial # The current serial number

[69] Fix | Delete

crlnumber = $dir/crlnumber # the current crl number

[70] Fix | Delete

# must be commented out to leave a V1 CRL

[71] Fix | Delete

crl = $dir/crl.pem # The current CRL

[72] Fix | Delete

private_key = $dir/private/cakey.pem# The private key

[73] Fix | Delete

[74] Fix | Delete

x509_extensions = usr_cert # The extensions to add to the cert

[75] Fix | Delete

[76] Fix | Delete

# Comment out the following two lines for the "traditional"

[77] Fix | Delete

# (and highly broken) format.

[78] Fix | Delete

name_opt = ca_default # Subject Name options

[79] Fix | Delete

cert_opt = ca_default # Certificate field options

[80] Fix | Delete

[81] Fix | Delete

# Extension copying option: use with caution.

[82] Fix | Delete

# copy_extensions = copy

[83] Fix | Delete

[84] Fix | Delete

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs

[85] Fix | Delete

# so this is commented out by default to leave a V1 CRL.

[86] Fix | Delete

# crlnumber must also be commented out to leave a V1 CRL.

[87] Fix | Delete

# crl_extensions = crl_ext

[88] Fix | Delete

[89] Fix | Delete

default_days = 365 # how long to certify for

[90] Fix | Delete

default_crl_days= 30 # how long before next CRL

[91] Fix | Delete

default_md = sha256 # use SHA-256 by default

[92] Fix | Delete

preserve = no # keep passed DN ordering

[93] Fix | Delete

[94] Fix | Delete

# A few difference way of specifying how similar the request should look

[95] Fix | Delete

# For type CA, the listed attributes must be the same, and the optional

[96] Fix | Delete

# and supplied fields are just that :-)

[97] Fix | Delete

policy = policy_match

[98] Fix | Delete

[99] Fix | Delete

# For the CA policy

[100] Fix | Delete

[ policy_match ]

[101] Fix | Delete

countryName = match

[102] Fix | Delete

stateOrProvinceName = match

[103] Fix | Delete

organizationName = match

[104] Fix | Delete

organizationalUnitName = optional

[105] Fix | Delete

commonName = supplied

[106] Fix | Delete

emailAddress = optional

[107] Fix | Delete

[108] Fix | Delete

# For the 'anything' policy

[109] Fix | Delete

# At this point in time, you must list all acceptable 'object'

[110] Fix | Delete

# types.

[111] Fix | Delete

[ policy_anything ]

[112] Fix | Delete

countryName = optional

[113] Fix | Delete

stateOrProvinceName = optional

[114] Fix | Delete

localityName = optional

[115] Fix | Delete

organizationName = optional

[116] Fix | Delete

organizationalUnitName = optional

[117] Fix | Delete

commonName = supplied

[118] Fix | Delete

emailAddress = optional

[119] Fix | Delete

[120] Fix | Delete

####################################################################

[121] Fix | Delete

[ req ]

[122] Fix | Delete

default_bits = 2048

[123] Fix | Delete

default_md = sha256

[124] Fix | Delete

default_keyfile = privkey.pem

[125] Fix | Delete

distinguished_name = req_distinguished_name

[126] Fix | Delete

attributes = req_attributes

[127] Fix | Delete

x509_extensions = v3_ca # The extensions to add to the self signed cert

[128] Fix | Delete

[129] Fix | Delete

# Passwords for private keys if not present they will be prompted for

[130] Fix | Delete

# input_password = secret

[131] Fix | Delete

# output_password = secret

[132] Fix | Delete

[133] Fix | Delete

# This sets a mask for permitted string types. There are several options.

[134] Fix | Delete

# default: PrintableString, T61String, BMPString.

[135] Fix | Delete

# pkix : PrintableString, BMPString (PKIX recommendation before 2004)

[136] Fix | Delete

# utf8only: only UTF8Strings (PKIX recommendation after 2004).

[137] Fix | Delete

# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).

[138] Fix | Delete

# MASK:XXXX a literal mask value.

[139] Fix | Delete

# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.

[140] Fix | Delete

string_mask = utf8only

[141] Fix | Delete

[142] Fix | Delete

# req_extensions = v3_req # The extensions to add to a certificate request

[143] Fix | Delete

[144] Fix | Delete

[ req_distinguished_name ]

[145] Fix | Delete

countryName = Country Name (2 letter code)

[146] Fix | Delete

countryName_default = XX

[147] Fix | Delete

countryName_min = 2

[148] Fix | Delete

countryName_max = 2

[149] Fix | Delete

[150] Fix | Delete

stateOrProvinceName = State or Province Name (full name)

[151] Fix | Delete

#stateOrProvinceName_default = Default Province

[152] Fix | Delete

[153] Fix | Delete

localityName = Locality Name (eg, city)

[154] Fix | Delete

localityName_default = Default City

[155] Fix | Delete

[156] Fix | Delete

0.organizationName = Organization Name (eg, company)

[157] Fix | Delete

0.organizationName_default = Default Company Ltd

[158] Fix | Delete

[159] Fix | Delete

# we can do this but it is not needed normally :-)

[160] Fix | Delete

#1.organizationName = Second Organization Name (eg, company)

[161] Fix | Delete

#1.organizationName_default = World Wide Web Pty Ltd

[162] Fix | Delete

[163] Fix | Delete

organizationalUnitName = Organizational Unit Name (eg, section)

[164] Fix | Delete

#organizationalUnitName_default =

[165] Fix | Delete

[166] Fix | Delete

commonName = Common Name (eg, your name or your server\'s hostname)

[167] Fix | Delete

commonName_max = 64

[168] Fix | Delete

[169] Fix | Delete

emailAddress = Email Address

[170] Fix | Delete

emailAddress_max = 64

[171] Fix | Delete

[172] Fix | Delete

# SET-ex3 = SET extension number 3

[173] Fix | Delete

[174] Fix | Delete

[ req_attributes ]

[175] Fix | Delete

challengePassword = A challenge password

[176] Fix | Delete

challengePassword_min = 4

[177] Fix | Delete

challengePassword_max = 20

[178] Fix | Delete

[179] Fix | Delete

unstructuredName = An optional company name

[180] Fix | Delete

[181] Fix | Delete

[ usr_cert ]

[182] Fix | Delete

[183] Fix | Delete

# These extensions are added when 'ca' signs a request.

[184] Fix | Delete

[185] Fix | Delete

# This goes against PKIX guidelines but some CAs do it and some software

[186] Fix | Delete

# requires this to avoid interpreting an end user certificate as a CA.

[187] Fix | Delete

[188] Fix | Delete

basicConstraints=CA:FALSE

[189] Fix | Delete

[190] Fix | Delete

# Here are some examples of the usage of nsCertType. If it is omitted

[191] Fix | Delete

# the certificate can be used for anything *except* object signing.

[192] Fix | Delete

[193] Fix | Delete

# This is OK for an SSL server.

[194] Fix | Delete

# nsCertType = server

[195] Fix | Delete

[196] Fix | Delete

# For an object signing certificate this would be used.

[197] Fix | Delete

# nsCertType = objsign

[198] Fix | Delete

[199] Fix | Delete

# For normal client use this is typical

[200] Fix | Delete

# nsCertType = client, email

[201] Fix | Delete

[202] Fix | Delete

# and for everything including object signing:

[203] Fix | Delete

# nsCertType = client, email, objsign

[204] Fix | Delete

[205] Fix | Delete

# This is typical in keyUsage for a client certificate.

[206] Fix | Delete

# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[207] Fix | Delete

[208] Fix | Delete

# This will be displayed in Netscape's comment listbox.

[209] Fix | Delete

nsComment = "OpenSSL Generated Certificate"

[210] Fix | Delete

[211] Fix | Delete

# PKIX recommendations harmless if included in all certificates.

[212] Fix | Delete

subjectKeyIdentifier=hash

[213] Fix | Delete

authorityKeyIdentifier=keyid,issuer

[214] Fix | Delete

[215] Fix | Delete

# This stuff is for subjectAltName and issuerAltname.

[216] Fix | Delete

# Import the email address.

[217] Fix | Delete

# subjectAltName=email:copy

[218] Fix | Delete

# An alternative to produce certificates that aren't

[219] Fix | Delete

# deprecated according to PKIX.

[220] Fix | Delete

# subjectAltName=email:move

[221] Fix | Delete

[222] Fix | Delete

# Copy subject details

[223] Fix | Delete

# issuerAltName=issuer:copy

[224] Fix | Delete

[225] Fix | Delete

#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem

[226] Fix | Delete

#nsBaseUrl

[227] Fix | Delete

#nsRevocationUrl

[228] Fix | Delete

#nsRenewalUrl

[229] Fix | Delete

#nsCaPolicyUrl

[230] Fix | Delete

#nsSslServerName

[231] Fix | Delete

[232] Fix | Delete

# This is required for TSA certificates.

[233] Fix | Delete

# extendedKeyUsage = critical,timeStamping

[234] Fix | Delete

[235] Fix | Delete

[ v3_req ]

[236] Fix | Delete

[237] Fix | Delete

# Extensions to add to a certificate request

[238] Fix | Delete

[239] Fix | Delete

basicConstraints = CA:FALSE

[240] Fix | Delete

keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[241] Fix | Delete

[242] Fix | Delete

[ v3_ca ]

[243] Fix | Delete

[244] Fix | Delete

[245] Fix | Delete

# Extensions for a typical CA

[246] Fix | Delete

[247] Fix | Delete

[248] Fix | Delete

# PKIX recommendation.

[249] Fix | Delete

[250] Fix | Delete

subjectKeyIdentifier=hash

[251] Fix | Delete

[252] Fix | Delete

authorityKeyIdentifier=keyid:always,issuer

[253] Fix | Delete

[254] Fix | Delete

basicConstraints = critical,CA:true

[255] Fix | Delete

[256] Fix | Delete

# Key usage: this is typical for a CA certificate. However since it will

[257] Fix | Delete

# prevent it being used as an test self-signed certificate it is best

[258] Fix | Delete

# left out by default.

[259] Fix | Delete

# keyUsage = cRLSign, keyCertSign

[260] Fix | Delete

[261] Fix | Delete

# Some might want this also

[262] Fix | Delete

# nsCertType = sslCA, emailCA

[263] Fix | Delete

[264] Fix | Delete

# Include email address in subject alt name: another PKIX recommendation

[265] Fix | Delete

# subjectAltName=email:copy

[266] Fix | Delete

# Copy issuer details

[267] Fix | Delete

# issuerAltName=issuer:copy

[268] Fix | Delete

[269] Fix | Delete

# DER hex encoding of an extension: beware experts only!

[270] Fix | Delete

# obj=DER:02:03

[271] Fix | Delete

# Where 'obj' is a standard or added object

[272] Fix | Delete

# You can even override a supported extension:

[273] Fix | Delete

# basicConstraints= critical, DER:30:03:01:01:FF

[274] Fix | Delete

[275] Fix | Delete

[ crl_ext ]

[276] Fix | Delete

[277] Fix | Delete

# CRL extensions.

[278] Fix | Delete

# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

[279] Fix | Delete

[280] Fix | Delete

# issuerAltName=issuer:copy

[281] Fix | Delete

authorityKeyIdentifier=keyid:always

[282] Fix | Delete

[283] Fix | Delete

[ proxy_cert_ext ]

[284] Fix | Delete

# These extensions should be added when creating a proxy certificate

[285] Fix | Delete

[286] Fix | Delete

# This goes against PKIX guidelines but some CAs do it and some software

[287] Fix | Delete

# requires this to avoid interpreting an end user certificate as a CA.

[288] Fix | Delete

[289] Fix | Delete

basicConstraints=CA:FALSE

[290] Fix | Delete

[291] Fix | Delete

# Here are some examples of the usage of nsCertType. If it is omitted

[292] Fix | Delete

# the certificate can be used for anything *except* object signing.

[293] Fix | Delete

[294] Fix | Delete

# This is OK for an SSL server.

[295] Fix | Delete

# nsCertType = server

[296] Fix | Delete

[297] Fix | Delete

# For an object signing certificate this would be used.

[298] Fix | Delete

# nsCertType = objsign

[299] Fix | Delete

[300] Fix | Delete

# For normal client use this is typical

[301] Fix | Delete

# nsCertType = client, email

[302] Fix | Delete

[303] Fix | Delete

# and for everything including object signing:

[304] Fix | Delete

# nsCertType = client, email, objsign

[305] Fix | Delete

[306] Fix | Delete

# This is typical in keyUsage for a client certificate.

[307] Fix | Delete

# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[308] Fix | Delete

[309] Fix | Delete

# This will be displayed in Netscape's comment listbox.

[310] Fix | Delete

nsComment = "OpenSSL Generated Certificate"

[311] Fix | Delete

[312] Fix | Delete

# PKIX recommendations harmless if included in all certificates.

[313] Fix | Delete

subjectKeyIdentifier=hash

[314] Fix | Delete

authorityKeyIdentifier=keyid,issuer

[315] Fix | Delete

[316] Fix | Delete

# This stuff is for subjectAltName and issuerAltname.

[317] Fix | Delete

# Import the email address.

[318] Fix | Delete

# subjectAltName=email:copy

[319] Fix | Delete

# An alternative to produce certificates that aren't

[320] Fix | Delete

# deprecated according to PKIX.

[321] Fix | Delete

# subjectAltName=email:move

[322] Fix | Delete

[323] Fix | Delete

# Copy subject details

[324] Fix | Delete

# issuerAltName=issuer:copy

[325] Fix | Delete

[326] Fix | Delete

#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem

[327] Fix | Delete

#nsBaseUrl

[328] Fix | Delete

#nsRevocationUrl

[329] Fix | Delete

#nsRenewalUrl

[330] Fix | Delete

#nsCaPolicyUrl

[331] Fix | Delete

#nsSslServerName

[332] Fix | Delete

[333] Fix | Delete

# This really needs to be in place for it to be a proxy certificate.

[334] Fix | Delete

proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

[335] Fix | Delete

[336] Fix | Delete

####################################################################

[337] Fix | Delete

[ tsa ]

[338] Fix | Delete

[339] Fix | Delete

default_tsa = tsa_config1 # the default TSA section

[340] Fix | Delete

[341] Fix | Delete

[ tsa_config1 ]

[342] Fix | Delete

[343] Fix | Delete

# These are used by the TSA reply generation only.

[344] Fix | Delete

dir = /etc/pki/CA # TSA root directory

[345] Fix | Delete

serial = $dir/tsaserial # The current serial number (mandatory)

[346] Fix | Delete

crypto_device = builtin # OpenSSL engine to use for signing

[347] Fix | Delete

signer_cert = $dir/tsacert.pem # The TSA signing certificate

[348] Fix | Delete

# (optional)

[349] Fix | Delete

certs = $dir/cacert.pem # Certificate chain to include in reply

[350] Fix | Delete

# (optional)

[351] Fix | Delete

signer_key = $dir/private/tsakey.pem # The TSA private key (optional)

[352] Fix | Delete

signer_digest = sha256 # Signing digest to use. (Optional)

[353] Fix | Delete

default_policy = tsa_policy1 # Policy if request did not specify it

[354] Fix | Delete

# (optional)

[355] Fix | Delete

other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)

[356] Fix | Delete

digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory)

[357] Fix | Delete

accuracy = secs:1, millisecs:500, microsecs:100 # (optional)

[358] Fix | Delete

clock_precision_digits = 0 # number of digits after dot. (optional)

[359] Fix | Delete

ordering = yes # Is ordering defined for timestamps?

[360] Fix | Delete

# (optional, default: no)

[361] Fix | Delete

tsa_name = yes # Must the TSA name be included in the reply?

[362] Fix | Delete

# (optional, default: no)

[363] Fix | Delete

ess_cert_id_chain = no # Must the ESS cert id chain be included?

[364] Fix | Delete

# (optional, default: no)

[365] Fix | Delete

ess_cert_id_alg = sha256 # algorithm to compute certificate

[366] Fix | Delete

# identifier (optional, default: sha1)

[367] Fix | Delete

[368] Fix | Delete