123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395 |
- HOME = .
- oid_section = new_oids
- [ new_oids ]
- tsa_policy1 = 1.2.3.4.1
- tsa_policy2 = 1.2.3.4.5.6
- tsa_policy3 = 1.2.3.4.5.7
- [ ca ]
- default_ca = CA_default
- [ CA_default ]
- dir = $HOME./..
- certs = $dir/certs
- crl_dir = $dir/certs/crl
- database = $dir/certs/crl/demoCA/index.txt
- new_certs_dir = $dir/certs
- certificate = $dir/certs/ca-cert.pem
- serial = $dir/certs/serial
- crlnumber = $dir/certs/crl/crlnumber
- crl = $dir/certs/crl/crl.pem
- private_key = $dir/certs/ca-key.pem
- RANDFILE = $dir/certs/.rnd
- x509_extensions = usr_cert
- name_opt = ca_default
- cert_opt = ca_default
- default_days = 1000
- default_crl_days = 30
- default_md = default
- preserve = no
- policy = policy_match
- [ policy_match ]
- countryName = match
- stateOrProvinceName = match
- organizationName = match
- organizationalUnitName = optional
- commonName = supplied
- emailAddress = optional
- [ policy_anything ]
- countryName = optional
- stateOrProvinceName = optional
- localityName = optional
- organizationName = optional
- organizationalUnitName = optional
- commonName = supplied
- emailAddress = optional
- [ req ]
- default_bits = 2048
- default_keyfile = privkey.pem
- distinguished_name = req_distinguished_name
- attributes = req_attributes
- x509_extensions = v3_ca
- string_mask = utf8only
- [ req_distinguished_name ]
- countryName = Country Name (2 letter code)
- countryName_default = US
- countryName_min = 2
- countryName_max = 2
- stateOrProvinceName = State or Province Name (full name)
- stateOrProvinceName_default = Montana
- localityName = Locality Name (eg, city)
- localityName_default = Bozeman
- 0.organizationName = Organization Name (eg, company)
- 0.organizationName_default = Sawtooth
- organizationalUnitName = Organizational Unit Name (eg, section)
- organizationalUnitName_default = Consulting
- commonName = Common Name (e.g. server FQDN or YOUR name)
- commonName_default = www.wolfssl.com
- commonName_max = 64
- emailAddress = Email Address
- emailAddress_default = info@wolfssl.com
- emailAddress_max = 64
- userId = User ID
- userId_default = wolfSSL
- [ req_attributes ]
- challengePassword = A challenge password
- challengePassword_min = 4
- challengePassword_max = 20
- unstructuredName = An optional company name
- [ usr_cert ]
- basicConstraints=CA:FALSE
- nsComment = "wolfSSL Generated Certificate using openSSL command line utility."
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid,issuer
- [wolfssl_opts]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true
- subjectAltName=DNS:example.com, IP:127.0.0.1
- extendedKeyUsage=serverAuth, clientAuth
- [wolfssl_opts_ICA]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true
- keyUsage=keyCertSign, cRLSign
- [ pathlen_0 ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true,pathlen:0
- keyUsage=keyCertSign, cRLSign
- [ pathlen_1 ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true,pathlen:1
- keyUsage=keyCertSign, cRLSign
- [ pathlen_127 ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true,pathlen:127
- keyUsage=keyCertSign, cRLSign
- [ pathlen_100 ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true,pathlen:100
- keyUsage=keyCertSign, cRLSign
- [ pathlen_128 ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true,pathlen:128
- keyUsage=keyCertSign, cRLSign
- [ pathlen_5 ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true,pathlen:5
- keyUsage=keyCertSign, cRLSign
- [ pathlen_10 ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true,pathlen:10
- keyUsage=keyCertSign, cRLSign
- [ pathlen_20 ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true,pathlen:20
- keyUsage=keyCertSign, cRLSign
- [ pathlen_99 ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true,pathlen:99
- keyUsage=keyCertSign, cRLSign
- [ pathlen_2 ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true,pathlen:2
- keyUsage=keyCertSign, cRLSign
- [ test_pathlen ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:false
- [ entity_no_CA_BOOL ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=pathlen:0
- keyUsage=digitalSignature
- extendedKeyUsage=clientAuth,serverAuth
- [ v3_req ]
- basicConstraints = CA:FALSE
- keyUsage = nonRepudiation, digitalSignature, keyEncipherment
- [ v3_ca ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints = CA:true
- [ crl_ext ]
- authorityKeyIdentifier=keyid:always
- [ proxy_cert_ext ]
- basicConstraints=CA:FALSE
- nsComment = "wolfSSL Generated Certificate using openSSL command line utility"
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid,issuer
- proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
- [ policy_test ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:FALSE
- certificatePolicies=1.2.3.4,@policy_add
- [ policy_add ]
- policyIdentifier=1.2.3.4
- CPS.1="www.wolfssl.com"
- userNotice.1=@policy_usr
- [ policy_usr ]
- explicitText="Test of duplicate OIDs with different qualifiers"
- [ digsigku ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=critical, CA:TRUE
- keyUsage=critical, nonRepudiation, keyEncipherment
- [ ca_ecc_cert ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always
- basicConstraints=critical, CA:TRUE
- keyUsage=critical, digitalSignature, keyCertSign, cRLSign
- [ server_ecc ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always
- basicConstraints=critical, CA:FALSE
- keyUsage=critical, digitalSignature, keyEncipherment, keyAgreement
- extendedKeyUsage=serverAuth
- nsCertType=server
- [ client_ecc ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always
- basicConstraints=critical, CA:FALSE
- keyUsage=critical, digitalSignature, keyEncipherment, keyAgreement
- extendedKeyUsage=clientAuth
- [ uri ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:false
- subjectAltName=URI:https://www.wolfssl.com
- [ absolute_urn ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:false
- subjectAltName=URI:urn:example:test
- [ relative_uri ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:false
- subjectAltName=URI:../relative/page.html
- [ client_cert_ext ]
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints=CA:true
- subjectAltName=DNS:example.com
- keyUsage=critical, digitalSignature, keyCertSign, cRLSign
- [ crl_dist_points ]
- crlDistributionPoints=URI:http://www.wolfssl.com/crl.pem
- [ tsa ]
- default_tsa = tsa_config1
- [ tsa_config1 ]
- dir = ./demoCA
- serial = $dir/tsaserial
- crypto_device = builtin
- signer_cert = $dir/tsacert.pem
- certs = $dir/cacert.pem
- signer_key = $dir/private/tsakey.pem
- default_policy = tsa_policy1
- other_policies = tsa_policy2, tsa_policy3
- digests = md5, sha1
- accuracy = secs:1, millisecs:500, microsecs:100
- clock_precision_digits = 0
- ordering = yes
- tsa_name = yes
- ess_cert_id_chain = no
- [fpki_ext]
- basicConstraints = CA:FALSE,pathlen:0
- subjectKeyIdentifier = hash
- authorityKeyIdentifier = keyid
- keyUsage = critical, digitalSignature
- extendedKeyUsage = critical, clientAuth, 1.3.6.1.4.1.311.20.2.2, 1.3.6.1.5.2.3.4, 1.3.6.1.5.5.7.3.21
- subjectAltName = @FASC_UUID_altname
- certificatePolicies = 2.16.840.1.101.3.2.1.3.13, 2.16.840.1.101.3.2.1.3.40, 2.16.840.1.101.3.2.1.3.41, 2.16.840.1.101.3.2.1.3.45
- subjectDirectoryAttributes = ASN1:SEQUENCE:SubjDirAttr
- policyConstraints = requireExplicitPolicy:0
- 2.16.840.1.101.3.6.10.1 = ASN1:SEQUENCE:PIVCertExt
- [FASC_UUID_altname]
- otherName.1 = 1.3.6.1.4.1.311.20.2.3
- otherName.2 = 2.16.840.1.101.3.6.6
- URI = urn:uuid:f81d4fae-7dec-11d0-a765-00a0c91e6bf6
- [SubjDirAttr]
- attribute = SEQUENCE:SDA_attr
- [SDA_attr]
- type = OID:1.3.6.1.5.5.7.9.4
- values = SET:SDA_coc
- [SDA_coc]
- value = PRINTABLESTRING:US
- [PIVCertExt]
- attribute = SEQUENCE:PCE_attr
- [PCE_attr]
- type = OID:2.16.840.1.101.3.6.9.1
- value = BOOLEAN:true
- [rid_ext]
- basicConstraints = CA:FALSE,pathlen:0
- subjectKeyIdentifier = hash
- authorityKeyIdentifier = keyid
- keyUsage = critical, digitalSignature
- subjectAltName = @RID_altname
- [RID_altname]
- otherName.1 = 1.3.6.1.4.1.311.20.2.3
- RID.1 = 1.2.3.4.5
- DNS.1 = www.example.org
- URI.1 = https://www.wolfssl.com/
- otherName.2 = 2.16.840.1.101.3.6.6
|