| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170 |
- #
- # cyassl configuration file
- #
- HOME = .
- RANDFILE = $ENV::HOME/.rnd
- oid_section = new_oids
- [ new_oids ]
- # Policies used by the TSA examples.
- tsa_policy1 = 1.2.3.4.1
- tsa_policy2 = 1.2.3.4.5.6
- tsa_policy3 = 1.2.3.4.5.7
- ####################################################################
- [ ca ]
- default_ca = CA_default # The default ca section
- ####################################################################
- [ CA_default ]
- ####################################################################
- # CHANGE THIS LINE TO BE YOUR CYASSL_ROOT DIRECTORY #
- # #
- dir = $HOME./.. #
- ####################################################################
- certs = $dir/certs # Where the issued certs are kept
- crl_dir = $dir/certs/crl # Where the issued crl are kept
- database = $dir/certs/crl/demoCA/index.txt # database index file.
- new_certs_dir = $dir/certs # default place for new certs.
- certificate = $dir/certs/ca-cert.pem # The CA certificate
- serial = $dir/certs/serial # The current serial number
- crlnumber = $dir/certs/crl/crlnumber # the current crl number
- crl = $dir/certs/crl/crl.pem # The current CRL
- private_key = $dir/certs/ca-key.pem # The private key
- RANDFILE = $dir/certs/private/.rand # private random number file
- x509_extensions = usr_cert # The extentions to add to the cert
- name_opt = ca_default # Subject Name options
- cert_opt = ca_default # Certificate field options
- default_days = 1000 # how long to certify for
- default_crl_days = 30 # how long before next CRL
- default_md = default # use public key default MD
- preserve = no # keep passed DN ordering
- policy = policy_match
- # For the CA policy
- [ policy_match ]
- countryName = match
- stateOrProvinceName = match
- organizationName = match
- organizationalUnitName = optional
- commonName = supplied
- emailAddress = optional
- # For the 'anything' policy
- [ policy_anything ]
- countryName = optional
- stateOrProvinceName = optional
- localityName = optional
- organizationName = optional
- organizationalUnitName = optional
- commonName = supplied
- emailAddress = optional
- # default req
- [ req ]
- default_bits = 2048
- default_keyfile = privkey.pem
- distinguished_name = req_distinguished_name
- attributes = req_attributes
- x509_extensions = v3_ca # The extentions to add to the self signed cert
- string_mask = utf8only
- #default req_dist_name
- [ req_distinguished_name ]
- countryName = Country Name (2 letter code)
- countryName_default = US
- countryName_min = 2
- countryName_max = 2
- stateOrProvinceName = State or Province Name (full name)
- stateOrProvinceName_default = Montana
- localityName = Locality Name (eg, city)
- localityName_default = Bozeman
- 0.organizationName = Organization Name (eg, company)
- 0.organizationName_default = Sawtooth
- organizationalUnitName = Organizational Unit Name (eg, section)
- organizationalUnitName_default = Consulting
- commonName = Common Name (e.g. server FQDN or YOUR name)
- commonName_default = www.wolfssl.com
- commonName_max = 64
- emailAddress = Email Address
- emailAddress_default = info@wolfssl.com
- emailAddress_max = 64
- #default req_attr
- [ req_attributes ]
- challengePassword = A challenge password
- challengePassword_min = 4
- challengePassword_max = 20
- unstructuredName = An optional company name
- # These extensions are added when 'ca' signs a request.
- [ usr_cert ]
- basicConstraints=CA:FALSE
- nsComment = "cyaSSL Generated Certificate using openSSL command line utility."
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid,issuer
- #cyassl extensions
- [cyassl_opts]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true
- # Extensions to add to a certificate request
- [ v3_req ]
- basicConstraints = CA:FALSE
- keyUsage = nonRepudiation, digitalSignature, keyEncipherment
- # Extensions for a typical CA
- [ v3_ca ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints = CA:true
- # CRL extensions.
- [ crl_ext ]
- authorityKeyIdentifier=keyid:always
- # These extensions should be added when creating a proxy certificate
- [ proxy_cert_ext ]
- basicConstraints=CA:FALSE
- nsComment = "cyaSSL Generated Certificate using openSSL command line utility"
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid,issuer
- proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
- #tsa default
- [ tsa ]
- default_tsa = tsa_config1
- # These are used by the TSA reply generation only.
- [ tsa_config1 ]
- dir = ./demoCA # directory
- serial = $dir/tsaserial # (mandatory)
- crypto_device = builtin # engine
- signer_cert = $dir/tsacert.pem # certificate
- certs = $dir/cacert.pem # chain
- signer_key = $dir/private/tsakey.pem # (optional)
- default_policy = tsa_policy1 # Policy
- other_policies = tsa_policy2, tsa_policy3 # (optional)
- digests = md5, sha1 # (mandatory)
- accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
- clock_precision_digits = 0 # (optional)
- ordering = yes # timestamps?
- tsa_name = yes # include?
- ess_cert_id_chain = no # include chain?
|
