-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathopenssl-1.0.cnf
175 lines (134 loc) · 4.93 KB
/
openssl-1.0.cnf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
RANDFILE = pki/.rnd
####################################################################
[ ca ]
default_ca = CA_default # The default ca section
####################################################################
[ CA_default ]
dir = pki # Where everything is kept
certs = $dir/ca.db.certs # Where the issued certs are kept
crl_dir = $dir/ca.db.crl # Where the issued crl are kept
database = $dir/ca.db.index # database index file.
new_certs_dir = $dir/ca.db.certs # default place for new certs.
certificate = $dir/ca.crt # The CA certificate
serial = $dir/ca.db.serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/ca.key # The private key
RANDFILE = $dir/ca.db.rand # private random number file
unique_subject = no
# Set to 'no' to allow creation of several ctificates with same subject
default_days = 356 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = sha256 # use public key default MD
preserve = no # keep passed DN ordering
# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy = policy_match
# for pypki
use_smartcard = False
smartcard_slot = 0:2
chain_file = $dir/ca_chain.crt
# For the 'anything' policy, which defines allowed DN fields
[ policy_match ]
countryName = match
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
name = optional
emailAddress = optional
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ policy_usr ]
countryName = supplied
stateOrProvinceName = optional
localityName = optional
organizationName = supplied
organizationalUnitName = optional
commonName = supplied
emailAddress = supplied
####################################################################
# Easy-RSA request handling
# We key off $DN_MODE to determine how to format the DN
[ req ]
default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = py_v3_ca # The extentions to add to the self signed cert
req_extensions = py_v3_req
string_mask = nombstr
# A placeholder to handle the $EXTRA_EXTS feature:
#%EXTRA_EXTS% # Do NOT remove or change this line as $EXTRA_EXTS support requires it
####################################################################
# Easy-RSA DN (Subject) handling
# Easy-RSA DN for cn_only support:
[ cn_only ]
commonName = Common Name (eg: your user, host, or server name)
commonName_max = 64
#commonName_default = $ENV::EASYRSA_REQ_CN
# Easy-RSA DN for org support:
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = RU
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = not used
localityName = Locality Name (eg, city)
localityName_default = not used
0.organizationName = Organization Name (eg, company)
0.organizationName_default = Company
1.organizationName = Second Organization Name (eg, company)
1.organizationName_default = not used
organizationalUnitName = Organizational Unit Name (eg, section)
organizationalUnitName_default = not used
commonName = Common Name (eg: your user, host, or server name)
commonName_max = 64
commonName_default =
emailAddress = Email Address
emailAddress_default =
emailAddress_max = 64
[ req_attributes ]
# challengePassword = A challenge password
# challengePassword_min = 4
# challengePassword_max = 20
# unstructuredName = An optional company name
####################################################################
[ basic_exts ]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
[ py_v3_ca ]
# PKIX recommendations:
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
# This could be marked critical, but it's nice to support reading by any
# broken clients who attempt to do so.
basicConstraints = CA:true
# keyUsage = cRLSign, keyCertSign
# nsCertType = sslCA
[ crl_ext ]
# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always,issuer:always
[ srv_cert ]
basicConstraints=CA:FALSE
nsCertType = server
crlDistributionPoints = URI:http://openca.stepcart.com/crl.pem
nsComment = "OpenSSL Generated Server Certificate"
[ usr_cert ]
basicConstraints=CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
[ py_v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment