Ops, the logic of the second argument has to be coupled with the != test to

[openssl.git] / apps / openssl.cnf

diff --git a/apps/openssl.cnf b/apps/openssl.cnf
index 81dee570557d069621613762c8b4fa499c879b0d..49cff56f35eb1ddc6c469d43e20a5d6763e2a8f3 100644 (file)
--- a/apps/openssl.cnf
+++ b/apps/openssl.cnf
@@ -5,6 +5,15 @@
 
 RANDFILE               = $ENV::HOME/.rnd
 oid_file               = $ENV::HOME/.oid
+oid_section            = new_oids
+
+[ new_oids ]
+
+# We can add new OIDs in here for use by 'ca' and 'req'.
+# Add a simple OID like this:
+# testoid1=1.2.3.4
+# Or use config file substitution like this:
+# testoid2=${testoid1}.5.6
 
 ####################################################################
 [ ca ]
@@ -92,7 +101,7 @@ commonName_max                       = 64
 emailAddress                   = Email Address
 emailAddress_max               = 40
 
-SET-ex3                                = SET extension number 3
+# SET-ex3                      = SET extension number 3
 
 [ req_attributes ]
 challengePassword              = A challenge password
@@ -127,7 +136,18 @@ basicConstraints=CA:FALSE
 keyUsage = nonRepudiation, digitalSignature, keyEncipherment
 
 nsComment                      = "OpenSSL Generated Certificate"
+
+# PKIX recommendations
 subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+
+# Import the email address.
+
+subjectAltName=email:copy
+
+# Copy subject details
+
+issuerAltName=issuer:copy
 
 #nsCaRevocationUrl             = http://www.domain.dom/ca-crl.pem
 #nsBaseUrl
@@ -147,6 +167,8 @@ basicConstraints = CA:true
 
 subjectKeyIdentifier=hash
 
+authorityKeyIdentifier=keyid:always,issuer:always
+
 # This is what PKIX recommends but some broken software chokes on critical
 # extensions.
 #basicConstraints = critical,CA:true
@@ -156,3 +178,13 @@ keyUsage = cRLSign, keyCertSign
 
 # Some might want this also
 #nsCertType = sslCA, emailCA
+
+# Include email address in subject alt name: another PKIX recommendation
+subjectAltName=email:copy
+# Copy issuer details
+issuerAltName=issuer:copy
+
+# RAW DER hex encoding of an extension: beware experts only!
+# 1.2.3.5=RAW:02:03
+# You can even override a supported extension:
+# basicConstraints= critical, RAW:30:03:01:01:FF