-
Notifications
You must be signed in to change notification settings - Fork 1
/
openssl.cnf
151 lines (119 loc) · 4.07 KB
/
openssl.cnf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
# For use with Easy-RSA 3.1 and OpenSSL or LibreSSL
####################################################################
[ ca ]
# The default ca section
default_ca = CA_default
####################################################################
[ CA_default ]
# Where everything is kept
dir = pki
# Where the issued certs are keptA_PKI
certs = $dir
# Where the issued crl are kept
crl_dir = $dir
# database index file.
database = $dir/ca/index.txt
# default place for new certs.
new_certs_dir = $dir/certs
# The CA certificate
certificate = $dir/ca.pem
# The current serial number
serial = $dir/ca/serial
# The current CRL
crl = $dir/ca/crl.pem
# The private key
private_key = $dir/private/ca.key
# private random number file
RANDFILE = $dir/ca/.rand
# The extentions to add to the cert
x509_extensions = basic_exts
# This allows a V2 CRL. Ancient browsers don't like it, but anything Easy-RSA
# is designed for will. In return, we get the Issuer attached to CRLs.
crl_extensions = crl_ext
# how long to certify for
default_days = 3650
# how long before next CRL
default_crl_days= 3650
# use public key default MD
default_md = sha256
# keep passed DN ordering
preserve = no
# This allows to renew certificates which have not been revoked
unique_subject = no
# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy = policy_anything
# For the 'anything' policy, which defines allowed DN fields
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
name = optional
emailAddress = optional
####################################################################
# Easy-RSA request handling
# We key off $DN_MODE to determine how to format the DN
[ req ]
default_keyfile = privkey.pem
default_md = sha256
distinguished_name = cn_only
# The extentions to add to the self signed certSYRSA_DN
x509_extensions = easyrsa_ca
####################################################################
# Easy-RSA DN (Subject) handling
# Easy-RSA DN for cn_only support:
[ cn_only ]
commonName = Common Name (eg: your user, host, or server name)
commonName_max = 64
commonName_default = localhost
# Easy-RSA DN for org support:
[ org ]
countryName = Country Name (2 letter code)
countryName_default = DE
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default =
localityName = Locality Name (eg, city)
localityName_default =
0.organizationName = Organization Name (eg, company)
0.organizationName_default =
organizationalUnitName = Organizational Unit Name (eg, section)
organizationalUnitName_default =
commonName = Common Name (eg: your user, host, or server name)
commonName_max = 64
commonName_default = localhost
emailAddress = Email Address
emailAddress_default = admin@localhost
emailAddress_max = 64
####################################################################
# Easy-RSA cert extension handling
# This section is effectively unused as the main script sets extensions
# dynamically. This core section is left to support the odd usecase where
# a user calls openssl directly.
[ basic_exts ]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
# The Easy-RSA CA extensions
[ easyrsa_ca ]
# PKIX recommendations:
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
# This could be marked critical, but it's nice to support reading by any
# broken clients who attempt to do so.
basicConstraints = CA:true
# Limit key usage to CA tasks. If you really want to use the generated pair as
# a self-signed cert, comment this out.
keyUsage = cRLSign, keyCertSign
# nsCertType omitted by default. Let's try to let the deprecated stuff die.
# nsCertType = sslCA
# CRL extensions.
[ crl_ext ]
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always,issuer:always