| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384 |
- CA="RootCA"
- [ ca ]
- # `man ca`
- default_ca = CA_default
- [ CA_default ]
- # Directory and file locations.
- dir = /etc/ssl/certs
- certs = $dir
- crl_dir = /tmp
- new_certs_dir = $dir
- database = /tmp/index.txt
- serial = /tmp/serial
- RANDFILE = /tmp/rand
- # The root key and root certificate.
- private_key = $dir/${ENV::CA}.key
- certificate = $dir/${ENV::CA}.crt
- # For certificate revocation lists.
- crlnumber = /tmp/crlnumber
- crl = /tmp/${ENV::CA}.crl
- crl_extensions = crl_ext
- default_crl_days = 30
- # SHA-1 is deprecated, so use SHA-2 instead.
- default_md = sha256
- name_opt = ca_default
- cert_opt = ca_default
- default_days = 375
- preserve = no
- policy = policy_strict
- [ policy_strict ]
- # The root CA should only sign intermediate certificates that match.
- # See the POLICY FORMAT section of `man ca`.
- countryName = match
- stateOrProvinceName = match
- organizationName = match
- organizationalUnitName = optional
- commonName = supplied
- emailAddress = optional
- [ req ]
- # Options for the `req` tool (`man req`).
- default_bits = 2048
- distinguished_name = req_distinguished_name
- string_mask = utf8only
- # SHA-1 is deprecated, so use SHA-2 instead.
- default_md = sha256
- # Extension to add when the -x509 option is used.
- x509_extensions = v3_ca
- [ req_distinguished_name ]
- # See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
- countryName = Country Name (2 letter code)
- stateOrProvinceName = State or Province Name
- localityName = Locality Name
- 0.organizationName = Organization Name
- organizationalUnitName = Organizational Unit Name
- commonName = Common Name
- emailAddress = Email Address
- [ v3_ca ]
- # Extensions for a typical CA (`man x509v3_config`).
- subjectKeyIdentifier = hash
- authorityKeyIdentifier = keyid:always,issuer
- basicConstraints = critical, CA:true
- keyUsage = critical, digitalSignature, cRLSign, keyCertSign
- [ v3_intermediate_ca ]
- # Extensions for a typical intermediate CA (`man x509v3_config`).
- subjectKeyIdentifier = hash
- authorityKeyIdentifier = keyid:always,issuer
- basicConstraints = critical, CA:true, pathlen:0
- keyUsage = critical, digitalSignature, cRLSign, keyCertSign
- [ crl_ext ]
- # Extension for CRLs (`man x509v3_config`).
- authorityKeyIdentifier=keyid:always
|
