| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172 |
- # OpenSSL config: certificate authority (CA)
- # Default value
- [ default ]
- ca_name = _CA_NAME_ # CA name
- home = . # Top dir
- default_ca = ca # Default CA section
- name_opt = utf8,esc_ctrl,multiline,lname,align # Display UTF-8 characters
- # Certificate request
- [ req ]
- default_bits = 2048 # RSA key size
- encrypt_key = yes # Encrypted CA private key
- default_md = sha256 # Message Digest to use
- utf8 = yes # Input is UTF-8
- string_mask = utf8only # Emit UTF-8 strings
- prompt = no # Don't prompt for DN
- distinguished_name = ca_dn # DN section
- req_extensions = ca_ext # Desired extensions
- # CA certificate info
- [ ca_dn ]
- countryName = "US" # CA cert info
- stateOrProvinceName = "Wahington" # CA cert info
- organizationName = "Seattle" # CA cert info
- localityName = "WOLFSSL" # CA cert info
- organizationalUnitName = "_CA_DEPART_" # CA cert info
- commonName = "www.wolfssl.com" # Replaced during build proceduce
- # Extensions for signing CA certificate
- [ ca_ext ]
- keyUsage = critical,keyCertSign,cRLSign,digitalSignature # Limit key usage
- basicConstraints = critical,CA:true # Dont allow intermediary CA
- subjectKeyIdentifier = hash # SKI validation
- # CA operational settings
- [ ca ]
- default_ca = _CA_NAME_ # Default CA section
- # CA Section
- [ _CA_NAME_ ]
- certificate = $home/$ca_name.crt # CA certificate
- private_key = $home/private/$ca_name.key # CA private key
- new_certs_dir = $home/certs # Generated certificates
- database = $home/db/index # Index file of generated crt
- serial = $home/db/serial # Serial number file
- RANDFILE = $home/ca/private/random # Random file
- unique_subject = no # Dont require unique subject
- default_days = 3650 # How long to certify for
- default_md = sha256 # Message Digest to use
- policy = match_pol # Default naming policy
- email_in_dn = no # Dont add email to cert DN
- copy_extensions = copy # Copy extensions from CSR (!)
- x509_extensions = server_ext # Default cert extensions
- # Matching policy
- # Enforce that all cert issued by the CA match criteria
- # Useful for CA used internally with limited scope
- [ match_pol ]
- countryName = match
- stateOrProvinceName = match
- organizationName = match
- organizationalUnitName = optional
- commonName = supplied
- emailAddress = optional
- # Extension used when signing server cert
- [ _CERT_NAME_ ]
- basicConstraints = critical,CA:false # Dont allow intermediary CA
- nsCertType = server # Certificate type
- subjectKeyIdentifier = hash # SKI validation
- keyUsage = critical,digitalSignature,keyEncipherment # Define key usage
- extendedKeyUsage = clientAuth,serverAuth # key usage continued
|
