wolfssl.cnf 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395
  1. #
  2. # wolfssl configuration file
  3. #
  4. HOME = .
  5. oid_section = new_oids
  6. [ new_oids ]
  7. # Policies used by the TSA examples.
  8. tsa_policy1 = 1.2.3.4.1
  9. tsa_policy2 = 1.2.3.4.5.6
  10. tsa_policy3 = 1.2.3.4.5.7
  11. ####################################################################
  12. [ ca ]
  13. default_ca = CA_default # The default ca section
  14. ####################################################################
  15. [ CA_default ]
  16. ####################################################################
  17. # CHANGE THIS LINE TO BE YOUR WOLFSSL_ROOT DIRECTORY #
  18. # #
  19. dir = $HOME./.. #
  20. ####################################################################
  21. certs = $dir/certs # Where the issued certs are kept
  22. crl_dir = $dir/certs/crl # Where the issued crl are kept
  23. database = $dir/certs/crl/demoCA/index.txt # database index file.
  24. new_certs_dir = $dir/certs # default place for new certs.
  25. certificate = $dir/certs/ca-cert.pem # The CA certificate
  26. serial = $dir/certs/serial # The current serial number
  27. crlnumber = $dir/certs/crl/crlnumber # the current crl number
  28. crl = $dir/certs/crl/crl.pem # The current CRL
  29. private_key = $dir/certs/ca-key.pem # The private key
  30. RANDFILE = $dir/certs/.rnd # private random number file
  31. x509_extensions = usr_cert # The extensions to add to the cert
  32. name_opt = ca_default # Subject Name options
  33. cert_opt = ca_default # Certificate field options
  34. default_days = 1000 # how long to certify for
  35. default_crl_days = 30 # how long before next CRL
  36. default_md = default # use public key default MD
  37. preserve = no # keep passed DN ordering
  38. policy = policy_match
  39. # For the CA policy
  40. [ policy_match ]
  41. countryName = match
  42. stateOrProvinceName = match
  43. organizationName = match
  44. organizationalUnitName = optional
  45. commonName = supplied
  46. emailAddress = optional
  47. # For the 'anything' policy
  48. [ policy_anything ]
  49. countryName = optional
  50. stateOrProvinceName = optional
  51. localityName = optional
  52. organizationName = optional
  53. organizationalUnitName = optional
  54. commonName = supplied
  55. emailAddress = optional
  56. # default req
  57. [ req ]
  58. default_bits = 2048
  59. default_keyfile = privkey.pem
  60. distinguished_name = req_distinguished_name
  61. attributes = req_attributes
  62. x509_extensions = v3_ca # The extensions to add to the self signed cert
  63. string_mask = utf8only
  64. #default req_dist_name
  65. [ req_distinguished_name ]
  66. countryName = Country Name (2 letter code)
  67. countryName_default = US
  68. countryName_min = 2
  69. countryName_max = 2
  70. stateOrProvinceName = State or Province Name (full name)
  71. stateOrProvinceName_default = Montana
  72. localityName = Locality Name (eg, city)
  73. localityName_default = Bozeman
  74. 0.organizationName = Organization Name (eg, company)
  75. 0.organizationName_default = Sawtooth
  76. organizationalUnitName = Organizational Unit Name (eg, section)
  77. organizationalUnitName_default = Consulting
  78. commonName = Common Name (e.g. server FQDN or YOUR name)
  79. commonName_default = www.wolfssl.com
  80. commonName_max = 64
  81. emailAddress = Email Address
  82. emailAddress_default = info@wolfssl.com
  83. emailAddress_max = 64
  84. userId = User ID
  85. userId_default = wolfSSL
  86. #default req_attr
  87. [ req_attributes ]
  88. challengePassword = A challenge password
  89. challengePassword_min = 4
  90. challengePassword_max = 20
  91. unstructuredName = An optional company name
  92. # These extensions are added when 'ca' signs a request.
  93. [ usr_cert ]
  94. basicConstraints=CA:FALSE
  95. nsComment = "wolfSSL Generated Certificate using openSSL command line utility."
  96. subjectKeyIdentifier=hash
  97. authorityKeyIdentifier=keyid,issuer
  98. #wolfssl extensions
  99. [wolfssl_opts]
  100. subjectKeyIdentifier=hash
  101. authorityKeyIdentifier=keyid:always,issuer:always
  102. basicConstraints=CA:true
  103. subjectAltName=DNS:example.com, IP:127.0.0.1
  104. extendedKeyUsage=serverAuth, clientAuth
  105. #wolfssl extensions for intermediate CAs
  106. [wolfssl_opts_ICA]
  107. subjectKeyIdentifier=hash
  108. authorityKeyIdentifier=keyid:always,issuer:always
  109. basicConstraints=CA:true
  110. keyUsage=keyCertSign, cRLSign
  111. # CA with pathlen 0
  112. [ pathlen_0 ]
  113. subjectKeyIdentifier=hash
  114. authorityKeyIdentifier=keyid:always,issuer:always
  115. basicConstraints=CA:true,pathlen:0
  116. keyUsage=keyCertSign, cRLSign
  117. # CA with pathlen 1
  118. [ pathlen_1 ]
  119. subjectKeyIdentifier=hash
  120. authorityKeyIdentifier=keyid:always,issuer:always
  121. basicConstraints=CA:true,pathlen:1
  122. keyUsage=keyCertSign, cRLSign
  123. # CA with pathlen 127
  124. [ pathlen_127 ]
  125. subjectKeyIdentifier=hash
  126. authorityKeyIdentifier=keyid:always,issuer:always
  127. basicConstraints=CA:true,pathlen:127
  128. keyUsage=keyCertSign, cRLSign
  129. # CA with pathlen 100
  130. [ pathlen_100 ]
  131. subjectKeyIdentifier=hash
  132. authorityKeyIdentifier=keyid:always,issuer:always
  133. basicConstraints=CA:true,pathlen:100
  134. keyUsage=keyCertSign, cRLSign
  135. # CA with pathlen 128
  136. [ pathlen_128 ]
  137. subjectKeyIdentifier=hash
  138. authorityKeyIdentifier=keyid:always,issuer:always
  139. basicConstraints=CA:true,pathlen:128
  140. keyUsage=keyCertSign, cRLSign
  141. # CA with pathlen 5
  142. [ pathlen_5 ]
  143. subjectKeyIdentifier=hash
  144. authorityKeyIdentifier=keyid:always,issuer:always
  145. basicConstraints=CA:true,pathlen:5
  146. keyUsage=keyCertSign, cRLSign
  147. # CA with pathlen 10
  148. [ pathlen_10 ]
  149. subjectKeyIdentifier=hash
  150. authorityKeyIdentifier=keyid:always,issuer:always
  151. basicConstraints=CA:true,pathlen:10
  152. keyUsage=keyCertSign, cRLSign
  153. # CA with pathlen 20
  154. [ pathlen_20 ]
  155. subjectKeyIdentifier=hash
  156. authorityKeyIdentifier=keyid:always,issuer:always
  157. basicConstraints=CA:true,pathlen:20
  158. keyUsage=keyCertSign, cRLSign
  159. # CA with pathlen 99
  160. [ pathlen_99 ]
  161. subjectKeyIdentifier=hash
  162. authorityKeyIdentifier=keyid:always,issuer:always
  163. basicConstraints=CA:true,pathlen:99
  164. keyUsage=keyCertSign, cRLSign
  165. # CA with pathlen 2
  166. [ pathlen_2 ]
  167. subjectKeyIdentifier=hash
  168. authorityKeyIdentifier=keyid:always,issuer:always
  169. basicConstraints=CA:true,pathlen:2
  170. keyUsage=keyCertSign, cRLSign
  171. # test pathlen server cert
  172. [ test_pathlen ]
  173. subjectKeyIdentifier=hash
  174. authorityKeyIdentifier=keyid:always,issuer:always
  175. basicConstraints=CA:false
  176. [ entity_no_CA_BOOL ]
  177. subjectKeyIdentifier=hash
  178. authorityKeyIdentifier=keyid:always,issuer:always
  179. basicConstraints=pathlen:0
  180. keyUsage=digitalSignature
  181. extendedKeyUsage=clientAuth,serverAuth
  182. # Extensions to add to a certificate request
  183. [ v3_req ]
  184. basicConstraints = CA:FALSE
  185. keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  186. # Extensions for a typical CA
  187. [ v3_ca ]
  188. subjectKeyIdentifier=hash
  189. authorityKeyIdentifier=keyid:always,issuer:always
  190. basicConstraints = CA:true
  191. # CRL extensions.
  192. [ crl_ext ]
  193. authorityKeyIdentifier=keyid:always
  194. # These extensions should be added when creating a proxy certificate
  195. [ proxy_cert_ext ]
  196. basicConstraints=CA:FALSE
  197. nsComment = "wolfSSL Generated Certificate using openSSL command line utility"
  198. subjectKeyIdentifier=hash
  199. authorityKeyIdentifier=keyid,issuer
  200. proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
  201. # Test of rejecting duplicate policy extension OIDs
  202. [ policy_test ]
  203. subjectKeyIdentifier=hash
  204. authorityKeyIdentifier=keyid:always,issuer:always
  205. basicConstraints=CA:FALSE
  206. certificatePolicies=1.2.3.4,@policy_add
  207. [ policy_add ]
  208. policyIdentifier=1.2.3.4
  209. CPS.1="www.wolfssl.com"
  210. userNotice.1=@policy_usr
  211. [ policy_usr ]
  212. explicitText="Test of duplicate OIDs with different qualifiers"
  213. # create certificate without the digitalSignature bit set and uses sha1 sig
  214. [ digsigku ]
  215. subjectKeyIdentifier=hash
  216. authorityKeyIdentifier=keyid:always,issuer:always
  217. basicConstraints=critical, CA:TRUE
  218. keyUsage=critical, nonRepudiation, keyEncipherment
  219. # ca-ecc-cert extensions
  220. [ ca_ecc_cert ]
  221. subjectKeyIdentifier=hash
  222. authorityKeyIdentifier=keyid:always
  223. basicConstraints=critical, CA:TRUE
  224. keyUsage=critical, digitalSignature, keyCertSign, cRLSign
  225. # server-ecc extensions
  226. [ server_ecc ]
  227. subjectKeyIdentifier=hash
  228. authorityKeyIdentifier=keyid:always
  229. basicConstraints=critical, CA:FALSE
  230. keyUsage=critical, digitalSignature, keyEncipherment, keyAgreement
  231. extendedKeyUsage=serverAuth
  232. nsCertType=server
  233. # client-ecc extensions
  234. [ client_ecc ]
  235. subjectKeyIdentifier=hash
  236. authorityKeyIdentifier=keyid:always
  237. basicConstraints=critical, CA:FALSE
  238. keyUsage=critical, digitalSignature, keyEncipherment, keyAgreement
  239. extendedKeyUsage=clientAuth
  240. # test parsing URI
  241. [ uri ]
  242. subjectKeyIdentifier=hash
  243. authorityKeyIdentifier=keyid:always,issuer:always
  244. basicConstraints=CA:false
  245. subjectAltName=URI:https://www.wolfssl.com
  246. # test parsing absolute URN
  247. [ absolute_urn ]
  248. subjectKeyIdentifier=hash
  249. authorityKeyIdentifier=keyid:always,issuer:always
  250. basicConstraints=CA:false
  251. subjectAltName=URI:urn:example:test
  252. # test parsing relative URI
  253. [ relative_uri ]
  254. subjectKeyIdentifier=hash
  255. authorityKeyIdentifier=keyid:always,issuer:always
  256. basicConstraints=CA:false
  257. subjectAltName=URI:../relative/page.html
  258. # client cert ext
  259. [ client_cert_ext ]
  260. subjectKeyIdentifier=hash
  261. authorityKeyIdentifier=keyid:always,issuer:always
  262. basicConstraints=CA:true
  263. subjectAltName=DNS:example.com
  264. keyUsage=critical, digitalSignature, keyCertSign, cRLSign
  265. # test CRL distribution points
  266. [ crl_dist_points ]
  267. crlDistributionPoints=URI:http://www.wolfssl.com/crl.pem
  268. #tsa default
  269. [ tsa ]
  270. default_tsa = tsa_config1
  271. # These are used by the TSA reply generation only.
  272. [ tsa_config1 ]
  273. dir = ./demoCA # directory
  274. serial = $dir/tsaserial # (mandatory)
  275. crypto_device = builtin # engine
  276. signer_cert = $dir/tsacert.pem # certificate
  277. certs = $dir/cacert.pem # chain
  278. signer_key = $dir/private/tsakey.pem # (optional)
  279. default_policy = tsa_policy1 # Policy
  280. other_policies = tsa_policy2, tsa_policy3 # (optional)
  281. digests = md5, sha1 # (mandatory)
  282. accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
  283. clock_precision_digits = 0 # (optional)
  284. ordering = yes # timestamps?
  285. tsa_name = yes # include?
  286. ess_cert_id_chain = no # include chain?
  287. [fpki_ext]
  288. basicConstraints = CA:FALSE,pathlen:0
  289. subjectKeyIdentifier = hash
  290. authorityKeyIdentifier = keyid
  291. keyUsage = critical, digitalSignature
  292. extendedKeyUsage = critical, clientAuth, 1.3.6.1.4.1.311.20.2.2, 1.3.6.1.5.2.3.4, 1.3.6.1.5.5.7.3.21
  293. subjectAltName = @FASC_UUID_altname
  294. certificatePolicies = 2.16.840.1.101.3.2.1.3.13, 2.16.840.1.101.3.2.1.3.40, 2.16.840.1.101.3.2.1.3.41, 2.16.840.1.101.3.2.1.3.45
  295. subjectDirectoryAttributes = ASN1:SEQUENCE:SubjDirAttr
  296. policyConstraints = requireExplicitPolicy:0
  297. 2.16.840.1.101.3.6.10.1 = ASN1:SEQUENCE:PIVCertExt
  298. # using example UUID from RFC4122
  299. [FASC_UUID_altname]
  300. otherName.1 = 1.3.6.1.4.1.311.20.2.3;UTF8:facts@wolfssl.com
  301. otherName.2 = 2.16.840.1.101.3.6.6;FORMAT:HEX,OCT:D1:38:10:D8:28:AF:2C:10:84:35:15:A1:68:58:28:AF:02:10:86:A2:84:E7:39:C3:EB
  302. URI = urn:uuid:f81d4fae-7dec-11d0-a765-00a0c91e6bf6
  303. [SubjDirAttr]
  304. attribute = SEQUENCE:SDA_attr
  305. [SDA_attr]
  306. type = OID:1.3.6.1.5.5.7.9.4
  307. values = SET:SDA_coc
  308. [SDA_coc]
  309. value = PRINTABLESTRING:US
  310. [PIVCertExt]
  311. attribute = SEQUENCE:PCE_attr
  312. [PCE_attr]
  313. type = OID:2.16.840.1.101.3.6.9.1
  314. value = BOOLEAN:true
  315. [rid_ext]
  316. basicConstraints = CA:FALSE,pathlen:0
  317. subjectKeyIdentifier = hash
  318. authorityKeyIdentifier = keyid
  319. keyUsage = critical, digitalSignature
  320. subjectAltName = @RID_altname
  321. [RID_altname]
  322. otherName.1 = 1.3.6.1.4.1.311.20.2.3;UTF8:facts@wolfssl.com
  323. RID.1 = 1.2.3.4.5
  324. DNS.1 = www.example.org
  325. URI.1 = https://www.wolfssl.com/
  326. otherName.2 = 2.16.840.1.101.3.6.6;FORMAT:HEX,OCT:D1:38:10:D8:28:AF:2C:10:84:35:15:A1:68:58:28:AF:02:10:86:A2:84:E7:39:C3:EB