wolfssl.cnf 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322
  1. #
  2. # wolfssl configuration file
  3. #
  4. HOME = .
  5. RANDFILE = $ENV::HOME/.rnd
  6. oid_section = new_oids
  7. [ new_oids ]
  8. # Policies used by the TSA examples.
  9. tsa_policy1 = 1.2.3.4.1
  10. tsa_policy2 = 1.2.3.4.5.6
  11. tsa_policy3 = 1.2.3.4.5.7
  12. ####################################################################
  13. [ ca ]
  14. default_ca = CA_default # The default ca section
  15. ####################################################################
  16. [ CA_default ]
  17. ####################################################################
  18. # CHANGE THIS LINE TO BE YOUR WOLFSSL_ROOT DIRECTORY #
  19. # #
  20. dir = $HOME./.. #
  21. ####################################################################
  22. certs = $dir/certs # Where the issued certs are kept
  23. crl_dir = $dir/certs/crl # Where the issued crl are kept
  24. database = $dir/certs/crl/demoCA/index.txt # database index file.
  25. new_certs_dir = $dir/certs # default place for new certs.
  26. certificate = $dir/certs/ca-cert.pem # The CA certificate
  27. serial = $dir/certs/serial # The current serial number
  28. crlnumber = $dir/certs/crl/crlnumber # the current crl number
  29. crl = $dir/certs/crl/crl.pem # The current CRL
  30. private_key = $dir/certs/ca-key.pem # The private key
  31. RANDFILE = $dir/certs/private/.rand # private random number file
  32. x509_extensions = usr_cert # The extensions to add to the cert
  33. name_opt = ca_default # Subject Name options
  34. cert_opt = ca_default # Certificate field options
  35. default_days = 1000 # how long to certify for
  36. default_crl_days = 30 # how long before next CRL
  37. default_md = default # use public key default MD
  38. preserve = no # keep passed DN ordering
  39. policy = policy_match
  40. # For the CA policy
  41. [ policy_match ]
  42. countryName = match
  43. stateOrProvinceName = match
  44. organizationName = match
  45. organizationalUnitName = optional
  46. commonName = supplied
  47. emailAddress = optional
  48. # For the 'anything' policy
  49. [ policy_anything ]
  50. countryName = optional
  51. stateOrProvinceName = optional
  52. localityName = optional
  53. organizationName = optional
  54. organizationalUnitName = optional
  55. commonName = supplied
  56. emailAddress = optional
  57. # default req
  58. [ req ]
  59. default_bits = 2048
  60. default_keyfile = privkey.pem
  61. distinguished_name = req_distinguished_name
  62. attributes = req_attributes
  63. x509_extensions = v3_ca # The extensions to add to the self signed cert
  64. string_mask = utf8only
  65. #default req_dist_name
  66. [ req_distinguished_name ]
  67. countryName = Country Name (2 letter code)
  68. countryName_default = US
  69. countryName_min = 2
  70. countryName_max = 2
  71. stateOrProvinceName = State or Province Name (full name)
  72. stateOrProvinceName_default = Montana
  73. localityName = Locality Name (eg, city)
  74. localityName_default = Bozeman
  75. 0.organizationName = Organization Name (eg, company)
  76. 0.organizationName_default = Sawtooth
  77. organizationalUnitName = Organizational Unit Name (eg, section)
  78. organizationalUnitName_default = Consulting
  79. commonName = Common Name (e.g. server FQDN or YOUR name)
  80. commonName_default = www.wolfssl.com
  81. commonName_max = 64
  82. emailAddress = Email Address
  83. emailAddress_default = info@wolfssl.com
  84. emailAddress_max = 64
  85. #default req_attr
  86. [ req_attributes ]
  87. challengePassword = A challenge password
  88. challengePassword_min = 4
  89. challengePassword_max = 20
  90. unstructuredName = An optional company name
  91. # These extensions are added when 'ca' signs a request.
  92. [ usr_cert ]
  93. basicConstraints=CA:FALSE
  94. nsComment = "wolfSSL Generated Certificate using openSSL command line utility."
  95. subjectKeyIdentifier=hash
  96. authorityKeyIdentifier=keyid,issuer
  97. #wolfssl extensions
  98. [wolfssl_opts]
  99. subjectKeyIdentifier=hash
  100. authorityKeyIdentifier=keyid:always,issuer:always
  101. basicConstraints=CA:true
  102. subjectAltName=DNS:example.com, IP:127.0.0.1
  103. extendedKeyUsage=serverAuth, clientAuth
  104. #wolfssl extensions for intermediate CAs
  105. [wolfssl_opts_ICA]
  106. subjectKeyIdentifier=hash
  107. authorityKeyIdentifier=keyid:always,issuer:always
  108. basicConstraints=CA:true
  109. keyUsage=keyCertSign, cRLSign
  110. # CA with pathlen 0
  111. [ pathlen_0 ]
  112. subjectKeyIdentifier=hash
  113. authorityKeyIdentifier=keyid:always,issuer:always
  114. basicConstraints=CA:true,pathlen:0
  115. keyUsage=keyCertSign, cRLSign
  116. # CA with pathlen 1
  117. [ pathlen_1 ]
  118. subjectKeyIdentifier=hash
  119. authorityKeyIdentifier=keyid:always,issuer:always
  120. basicConstraints=CA:true,pathlen:1
  121. keyUsage=keyCertSign, cRLSign
  122. # CA with pathlen 127
  123. [ pathlen_127 ]
  124. subjectKeyIdentifier=hash
  125. authorityKeyIdentifier=keyid:always,issuer:always
  126. basicConstraints=CA:true,pathlen:127
  127. keyUsage=keyCertSign, cRLSign
  128. # CA with pathlen 100
  129. [ pathlen_100 ]
  130. subjectKeyIdentifier=hash
  131. authorityKeyIdentifier=keyid:always,issuer:always
  132. basicConstraints=CA:true,pathlen:100
  133. keyUsage=keyCertSign, cRLSign
  134. # CA with pathlen 128
  135. [ pathlen_128 ]
  136. subjectKeyIdentifier=hash
  137. authorityKeyIdentifier=keyid:always,issuer:always
  138. basicConstraints=CA:true,pathlen:128
  139. keyUsage=keyCertSign, cRLSign
  140. # CA with pathlen 5
  141. [ pathlen_5 ]
  142. subjectKeyIdentifier=hash
  143. authorityKeyIdentifier=keyid:always,issuer:always
  144. basicConstraints=CA:true,pathlen:5
  145. keyUsage=keyCertSign, cRLSign
  146. # CA with pathlen 10
  147. [ pathlen_10 ]
  148. subjectKeyIdentifier=hash
  149. authorityKeyIdentifier=keyid:always,issuer:always
  150. basicConstraints=CA:true,pathlen:10
  151. keyUsage=keyCertSign, cRLSign
  152. # CA with pathlen 20
  153. [ pathlen_20 ]
  154. subjectKeyIdentifier=hash
  155. authorityKeyIdentifier=keyid:always,issuer:always
  156. basicConstraints=CA:true,pathlen:20
  157. keyUsage=keyCertSign, cRLSign
  158. # CA with pathlen 99
  159. [ pathlen_99 ]
  160. subjectKeyIdentifier=hash
  161. authorityKeyIdentifier=keyid:always,issuer:always
  162. basicConstraints=CA:true,pathlen:99
  163. keyUsage=keyCertSign, cRLSign
  164. # CA with pathlen 2
  165. [ pathlen_2 ]
  166. subjectKeyIdentifier=hash
  167. authorityKeyIdentifier=keyid:always,issuer:always
  168. basicConstraints=CA:true,pathlen:2
  169. keyUsage=keyCertSign, cRLSign
  170. # test pathlen server cert
  171. [ test_pathlen ]
  172. subjectKeyIdentifier=hash
  173. authorityKeyIdentifier=keyid:always,issuer:always
  174. basicConstraints=CA:false
  175. [ entity_no_CA_BOOL ]
  176. subjectKeyIdentifier=hash
  177. authorityKeyIdentifier=keyid:always,issuer:always
  178. basicConstraints=pathlen:0
  179. keyUsage=digitalSignature
  180. extendedKeyUsage=clientAuth,serverAuth
  181. # Extensions to add to a certificate request
  182. [ v3_req ]
  183. basicConstraints = CA:FALSE
  184. keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  185. # Extensions for a typical CA
  186. [ v3_ca ]
  187. subjectKeyIdentifier=hash
  188. authorityKeyIdentifier=keyid:always,issuer:always
  189. basicConstraints = CA:true
  190. # CRL extensions.
  191. [ crl_ext ]
  192. authorityKeyIdentifier=keyid:always
  193. # These extensions should be added when creating a proxy certificate
  194. [ proxy_cert_ext ]
  195. basicConstraints=CA:FALSE
  196. nsComment = "wolfSSL Generated Certificate using openSSL command line utility"
  197. subjectKeyIdentifier=hash
  198. authorityKeyIdentifier=keyid,issuer
  199. proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
  200. # Test of rejecting duplicate policy extension OIDs
  201. [ policy_test ]
  202. subjectKeyIdentifier=hash
  203. authorityKeyIdentifier=keyid:always,issuer:always
  204. basicConstraints=CA:FALSE
  205. certificatePolicies=1.2.3.4,@policy_add
  206. [ policy_add ]
  207. policyIdentifier=1.2.3.4
  208. CPS.1="www.wolfssl.com"
  209. userNotice.1=@policy_usr
  210. [ policy_usr ]
  211. explicitText="Test of duplicate OIDs with different qualifiers"
  212. # create certificate without the digitalSignature bit set and uses sha1 sig
  213. [ digsigku ]
  214. subjectKeyIdentifier=hash
  215. authorityKeyIdentifier=keyid:always,issuer:always
  216. basicConstraints=critical, CA:TRUE
  217. keyUsage=critical, nonRepudiation, keyEncipherment
  218. # ca-ecc-cert extensions
  219. [ ca_ecc_cert ]
  220. subjectKeyIdentifier=hash
  221. authorityKeyIdentifier=keyid:always
  222. basicConstraints=critical, CA:TRUE
  223. keyUsage=critical, digitalSignature, keyCertSign, cRLSign
  224. # server-ecc extensions
  225. [ server_ecc ]
  226. subjectKeyIdentifier=hash
  227. authorityKeyIdentifier=keyid:always
  228. basicConstraints=critical, CA:FALSE
  229. keyUsage=critical, digitalSignature, keyEncipherment, keyAgreement
  230. extendedKeyUsage=serverAuth
  231. nsCertType=server
  232. # server-ecc extensions
  233. [ client_ecc ]
  234. subjectKeyIdentifier=hash
  235. authorityKeyIdentifier=keyid:always
  236. basicConstraints=critical, CA:FALSE
  237. keyUsage=critical, digitalSignature, keyEncipherment, keyAgreement
  238. extendedKeyUsage=clientAuth
  239. # test parsing URI
  240. [ uri ]
  241. subjectKeyIdentifier=hash
  242. authorityKeyIdentifier=keyid:always,issuer:always
  243. basicConstraints=CA:false
  244. subjectAltName=URI:https://www.wolfssl.com
  245. # test parsing relative URI
  246. [ relative_uri ]
  247. subjectKeyIdentifier=hash
  248. authorityKeyIdentifier=keyid:always,issuer:always
  249. basicConstraints=CA:false
  250. subjectAltName=URI:../relative/page.html
  251. #tsa default
  252. [ tsa ]
  253. default_tsa = tsa_config1
  254. # These are used by the TSA reply generation only.
  255. [ tsa_config1 ]
  256. dir = ./demoCA # directory
  257. serial = $dir/tsaserial # (mandatory)
  258. crypto_device = builtin # engine
  259. signer_cert = $dir/tsacert.pem # certificate
  260. certs = $dir/cacert.pem # chain
  261. signer_key = $dir/private/tsakey.pem # (optional)
  262. default_policy = tsa_policy1 # Policy
  263. other_policies = tsa_policy2, tsa_policy3 # (optional)
  264. digests = md5, sha1 # (mandatory)
  265. accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
  266. clock_precision_digits = 0 # (optional)
  267. ordering = yes # timestamps?
  268. tsa_name = yes # include?
  269. ess_cert_id_chain = no # include chain?