1###############################################################
2#
3#  Licensed to the Apache Software Foundation (ASF) under one
4#  or more contributor license agreements.  See the NOTICE file
5#  distributed with this work for additional information
6#  regarding copyright ownership.  The ASF licenses this file
7#  to you under the Apache License, Version 2.0 (the
8#  "License"); you may not use this file except in compliance
9#  with the License.  You may obtain a copy of the License at
10#
11#    http://www.apache.org/licenses/LICENSE-2.0
12#
13#  Unless required by applicable law or agreed to in writing,
14#  software distributed under the License is distributed on an
15#  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16#  KIND, either express or implied.  See the License for the
17#  specific language governing permissions and limitations
18#  under the License.
19#
20###############################################################
21
22#
23# OpenSSL example configuration file.
24# This is mostly being used for generation of certificate requests.
25#
26
27# This definition stops the following lines choking if HOME isn't
28# defined.
29HOME			= .
30RANDFILE		= $ENV::HOME/.rnd
31
32# Extra OBJECT IDENTIFIER info:
33#oid_file		= $ENV::HOME/.oid
34oid_section		= new_oids
35
36# To use this configuration file with the "-extfile" option of the
37# "openssl x509" utility, name here the section containing the
38# X.509v3 extensions to use:
39# extensions		=
40# (Alternatively, use a configuration file that has only
41# X.509v3 extensions in its main [= default] section.)
42
43[ new_oids ]
44
45# We can add new OIDs in here for use by 'ca' and 'req'.
46# Add a simple OID like this:
47# testoid1=1.2.3.4
48# Or use config file substitution like this:
49# testoid2=${testoid1}.5.6
50
51####################################################################
52[ ca ]
53default_ca	= CA_default		# The default ca section
54
55####################################################################
56[ CA_default ]
57
58dir		= ./demoCA		# Where everything is kept
59certs		= $dir/certs		# Where the issued certs are kept
60crl_dir		= $dir/crl		# Where the issued crl are kept
61database	= $dir/index.txt	# database index file.
62#unique_subject	= no			# Set to 'no' to allow creation of
63					# several ctificates with same subject.
64new_certs_dir	= $dir/newcerts		# default place for new certs.
65
66certificate	= $dir/cacert.pem 	# The CA certificate
67serial		= $dir/serial	# The current serial number
68crlnumber	= $dir/crlnumber	# the current crl number
69					# must be commented out to leave a V1 CRL
70crl		= $dir/crl.pem 		# The current CRL
71private_key	= $dir/private/cakey.pem 	# The private key
72RANDFILE	= $dir/private/.rand	 	# private random number file
73
74x509_extensions	= usr_cert		# The extentions to add to the cert
75
76# Comment out the following two lines for the "traditional"
77# (and highly broken) format.
78name_opt 	= ca_default		# Subject Name options
79cert_opt 	= ca_default		# Certificate field options
80
81# Extension copying option: use with caution.
82# copy_extensions = copy
83
84# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
85# so this is commented out by default to leave a V1 CRL.
86# crlnumber must also be commented out to leave a V1 CRL.
87# crl_extensions	= crl_ext
88
89default_days	= 365			# how long to certify for
90default_crl_days= 30			# how long before next CRL
91default_md	= sha1			# which md to use.
92preserve	= no			# keep passed DN ordering
93
94# A few difference way of specifying how similar the request should look
95# For type CA, the listed attributes must be the same, and the optional
96# and supplied fields are just that :-)
97policy		= policy_match
98
99# For the CA policy
100[ policy_match ]
101countryName		= match
102stateOrProvinceName	= match
103organizationName	= match
104organizationalUnitName	= optional
105commonName		= supplied
106emailAddress		= optional
107
108# For the 'anything' policy
109# At this point in time, you must list all acceptable 'object'
110# types.
111[ policy_anything ]
112countryName		= optional
113stateOrProvinceName	= optional
114localityName		= optional
115organizationName	= optional
116organizationalUnitName	= optional
117commonName		= supplied
118emailAddress		= optional
119
120####################################################################
121[ req ]
122default_bits		= 1024
123default_keyfile 	= privkey.pem
124distinguished_name	= req_distinguished_name
125attributes		= req_attributes
126x509_extensions	= v3_ca	# The extentions to add to the self signed cert
127
128# Passwords for private keys if not present they will be prompted for
129# input_password = secret
130# output_password = secret
131
132# This sets a mask for permitted string types. There are several options.
133# default: PrintableString, T61String, BMPString.
134# pkix	 : PrintableString, BMPString.
135# utf8only: only UTF8Strings.
136# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
137# MASK:XXXX a literal mask value.
138# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
139# so use this option with caution!
140string_mask = nombstr
141
142# req_extensions = v3_req # The extensions to add to a certificate request
143
144[ req_distinguished_name ]
145countryName			= Country Name (2 letter code)
146countryName_default		= DE
147countryName_min			= 2
148countryName_max			= 2
149
150stateOrProvinceName		= State or Province Name (full name)
151stateOrProvinceName_default	= Hamburg
152
153localityName			= Locality Name (eg, city)
154
1550.organizationName		= Organization Name (eg, company)
1560.organizationName_default	= OpenOffice.org
157
158# we can do this but it is not needed normally :-)
159#1.organizationName		= Second Organization Name (eg, company)
160#1.organizationName_default	= World Wide Web Pty Ltd
161
162organizationalUnitName		= Organizational Unit Name (eg, section)
163organizationalUnitName_default	= Development
164
165commonName			= Common Name (eg, YOUR name)
166commonName_max			= 64
167
168emailAddress			= Email Address
169emailAddress_max		= 64
170
171# SET-ex3			= SET extension number 3
172
173[ req_attributes ]
174challengePassword		= A challenge password
175challengePassword_min		= 4
176challengePassword_max		= 20
177
178unstructuredName		= An optional company name
179
180[ usr_cert ]
181
182# These extensions are added when 'ca' signs a request.
183authorityInfoAccess = OCSP;URI:http://localhost:8889
184#crlDistributionPoints=URI:http://localhost:8902/demoCA/crl/Sub_CA_2_Root_7.crl
185# This is typical in keyUsage for a client certificate.
186keyUsage = nonRepudiation, digitalSignature, keyEncipherment
187
188# This will be displayed in Netscape's comment listbox.
189#nsComment			= "OpenSSL Generated Certificate"
190
191# PKIX recommendations harmless if included in all certificates.
192subjectKeyIdentifier=hash
193authorityKeyIdentifier=keyid,issuer
194
195# This stuff is for subjectAltName and issuerAltname.
196# Import the email address.
197# subjectAltName=email:copy
198# An alternative to produce certificates that aren't
199# deprecated according to PKIX.
200# subjectAltName=email:move
201
202# Copy subject details
203# issuerAltName=issuer:copy
204
205
206
207[ v3_req ]
208
209# Extensions to add to a certificate request
210
211basicConstraints = CA:FALSE
212keyUsage = nonRepudiation, digitalSignature, keyEncipherment
213#authorityInfoAccess = OCSP;URI:http://localhost:8888/
214
215[ v3_ca ]
216
217
218# Extensions for a typical CA
219
220
221# PKIX recommendation.
222
223subjectKeyIdentifier=hash
224
225authorityKeyIdentifier=keyid:always,issuer:always
226
227#authorityInfoAccess = OCSP;URI:http://localhost:8888
228#crlDistributionPoints=URI:http://localhost:8901/demoCA/crl/Test_CA_2009.2.crl
229# This is what PKIX recommends but some broken software chokes on critical
230# extensions.
231#basicConstraints = critical,CA:true
232# So we do this instead.
233basicConstraints = critical, CA:true
234
235# Key usage: this is typical for a CA certificate. However since it will
236# prevent it being used as an test self-signed certificate it is best
237# left out by default.
238# keyUsage = cRLSign, keyCertSign
239
240# Some might want this also
241# nsCertType = sslCA, emailCA
242
243# Include email address in subject alt name: another PKIX recommendation
244# subjectAltName=email:copy
245# Copy issuer details
246# issuerAltName=issuer:copy
247
248# DER hex encoding of an extension: beware experts only!
249# obj=DER:02:03
250# Where 'obj' is a standard or added object
251# You can even override a supported extension:
252# basicConstraints= critical, DER:30:03:01:01:FF
253
254[ crl_ext ]
255
256# CRL extensions.
257# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
258
259# issuerAltName=issuer:copy
260authorityKeyIdentifier=keyid:always,issuer:always
261
262[ proxy_cert_ext ]
263# These extensions should be added when creating a proxy certificate
264
265# This goes against PKIX guidelines but some CAs do it and some software
266# requires this to avoid interpreting an end user certificate as a CA.
267
268basicConstraints=CA:FALSE
269
270# Here are some examples of the usage of nsCertType. If it is omitted
271# the certificate can be used for anything *except* object signing.
272
273# This is OK for an SSL server.
274# nsCertType			= server
275
276# For an object signing certificate this would be used.
277# nsCertType = objsign
278
279# For normal client use this is typical
280# nsCertType = client, email
281
282# and for everything including object signing:
283# nsCertType = client, email, objsign
284
285# This is typical in keyUsage for a client certificate.
286# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
287
288# This will be displayed in Netscape's comment listbox.
289nsComment			= "OpenSSL Generated Certificate"
290
291# PKIX recommendations harmless if included in all certificates.
292subjectKeyIdentifier=hash
293authorityKeyIdentifier=keyid,issuer:always
294
295# This stuff is for subjectAltName and issuerAltname.
296# Import the email address.
297# subjectAltName=email:copy
298# An alternative to produce certificates that aren't
299# deprecated according to PKIX.
300# subjectAltName=email:move
301
302# Copy subject details
303# issuerAltName=issuer:copy
304
305#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
306#nsBaseUrl
307#nsRevocationUrl
308#nsRenewalUrl
309#nsCaPolicyUrl
310#nsSslServerName
311
312# This really needs to be in place for it to be a proxy certificate.
313proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
314