2
0

ca-and-certs.cnf 2.2 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091
  1. # Comment out the next line to ignore configuration errors
  2. config_diagnostics = 1
  3. CN2 = Brother 2
  4. ####################################################################
  5. [ req ]
  6. distinguished_name = req_distinguished_name
  7. encrypt_rsa_key = no
  8. default_md = sha1
  9. [ req_distinguished_name ]
  10. countryName = Country Name (2 letter code)
  11. countryName_value = AU
  12. organizationName = Organization Name (eg, company)
  13. organizationName_value = Dodgy Brothers
  14. commonName = Common Name (eg, YOUR name)
  15. commonName_value = Dodgy CA
  16. ####################################################################
  17. [ userreq ]
  18. distinguished_name = user_dn
  19. encrypt_rsa_key = no
  20. default_md = sha256
  21. prompt = no
  22. [ user_dn ]
  23. countryName = AU
  24. organizationName = Dodgy Brothers
  25. 0.commonName = Brother 1
  26. 1.commonName = $ENV::CN2
  27. [ empty ]
  28. [ v3_ee ]
  29. subjectKeyIdentifier = hash
  30. authorityKeyIdentifier = keyid,issuer:always
  31. basicConstraints = CA:false
  32. keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  33. [ v3_ee_dsa ]
  34. subjectKeyIdentifier = hash
  35. authorityKeyIdentifier = keyid:always
  36. basicConstraints = CA:false
  37. keyUsage = nonRepudiation, digitalSignature
  38. [ v3_ee_ec ]
  39. subjectKeyIdentifier = hash
  40. authorityKeyIdentifier = keyid:always
  41. basicConstraints = CA:false
  42. keyUsage = nonRepudiation, digitalSignature, keyAgreement
  43. ####################################################################
  44. [ ca ]
  45. default_ca = CA_default
  46. [ CA_default ]
  47. dir = ./demoCA
  48. certs = $dir/certs
  49. crl_dir = $dir/crl
  50. database = $dir/index.txt
  51. new_certs_dir = $dir/newcerts
  52. certificate = $dir/cacert.pem
  53. serial = $dir/serial
  54. crl = $dir/crl.pem
  55. private_key = $dir/private/cakey.pem
  56. x509_extensions = v3_ca
  57. name_opt = ca_default
  58. cert_opt = ca_default
  59. default_days = 365
  60. default_crl_days= 30
  61. default_md = sha1
  62. preserve = no
  63. policy = policy_anything
  64. [ policy_anything ]
  65. countryName = optional
  66. stateOrProvinceName = optional
  67. localityName = optional
  68. organizationName = optional
  69. organizationalUnitName = optional
  70. commonName = supplied
  71. emailAddress = optional
  72. [ v3_ca ]
  73. subjectKeyIdentifier = hash
  74. authorityKeyIdentifier = keyid:always,issuer:always
  75. basicConstraints = critical,CA:true,pathlen:1
  76. keyUsage = cRLSign, keyCertSign
  77. issuerAltName = issuer:copy