Ops, the logic of the second argument has to be coupled with the != test to

[openssl.git] / apps / openssl.cnf

diff --git a/apps/openssl.cnf b/apps/openssl.cnf
index fbc328fad41ef9c218788fd9198442d4776b20ad..49cff56f35eb1ddc6c469d43e20a5d6763e2a8f3 100644 (file)
--- a/apps/openssl.cnf
+++ b/apps/openssl.cnf
@@ -5,6 +5,15 @@
 
 RANDFILE               = $ENV::HOME/.rnd
 oid_file               = $ENV::HOME/.oid
+oid_section            = new_oids
+
+[ new_oids ]
+
+# We can add new OIDs in here for use by 'ca' and 'req'.
+# Add a simple OID like this:
+# testoid1=1.2.3.4
+# Or use config file substitution like this:
+# testoid2=${testoid1}.5.6
 
 ####################################################################
 [ ca ]
@@ -25,7 +34,7 @@ crl           = $dir/crl.pem          # The current CRL
 private_key    = $dir/private/cakey.pem# The private key
 RANDFILE       = $dir/private/.rand    # private random number file
 
-x509_extensions        = x509v3_extensions     # The extentions to add to the cert
+x509_extensions        = usr_cert              # The extentions to add to the cert
 default_days   = 365                   # how long to certify for
 default_crl_days= 30                   # how long before next CRL
 default_md     = md5                   # which md to use.
@@ -63,7 +72,7 @@ default_bits          = 1024
 default_keyfile        = privkey.pem
 distinguished_name     = req_distinguished_name
 attributes             = req_attributes
-x509_extensions        = v3_ca # The extentions to add to the cert
+x509_extensions        = v3_ca # The extentions to add to the self signed cert
 
 [ req_distinguished_name ]
 countryName                    = Country Name (2 letter code)
@@ -92,7 +101,7 @@ commonName_max                       = 64
 emailAddress                   = Email Address
 emailAddress_max               = 40
 
-SET-ex3                                = SET extension number 3
+# SET-ex3                      = SET extension number 3
 
 [ req_attributes ]
 challengePassword              = A challenge password
@@ -101,28 +110,81 @@ challengePassword_max             = 20
 
 unstructuredName               = An optional company name
 
-[ x509v3_extensions ]
+[ usr_cert ]
+
+# These extensions are added when 'ca' signs a request.
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+
+# This is OK for an SSL server.
+#nsCertType                    = server
+
+# For an object signing certificate this would be used.
+#nsCertType = objsign
+
+# For normal client use this is typical
+#nsCertType = client, email
+
+# This is typical also
+
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
 
-nsCaRevocationUrl              = http://www.domain.dom/ca-crl.pem
-nsComment                      = "This is a comment"
+nsComment                      = "OpenSSL Generated Certificate"
 
-# under ASN.1, the 0 bit would be encoded as 80
-nsCertType                     = 0x40
+# PKIX recommendations
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
 
+# Import the email address.
+
+subjectAltName=email:copy
+
+# Copy subject details
+
+issuerAltName=issuer:copy
+
+#nsCaRevocationUrl             = http://www.domain.dom/ca-crl.pem
 #nsBaseUrl
 #nsRevocationUrl
 #nsRenewalUrl
 #nsCaPolicyUrl
 #nsSslServerName
-#nsCertSequence
-#nsCertExt
-#nsDataType
 
 [ v3_ca]
 
 # Extensions for a typical CA
 
+# It's a CA certificate
 basicConstraints = CA:true
+
+# PKIX recommendation.
+
+subjectKeyIdentifier=hash
+
+authorityKeyIdentifier=keyid:always,issuer:always
+
+# This is what PKIX recommends but some broken software chokes on critical
+# extensions.
+#basicConstraints = critical,CA:true
+
+# Key usage: again this should really be critical.
 keyUsage = cRLSign, keyCertSign
 
+# Some might want this also
+#nsCertType = sslCA, emailCA
+
+# Include email address in subject alt name: another PKIX recommendation
+subjectAltName=email:copy
+# Copy issuer details
+issuerAltName=issuer:copy
 
+# RAW DER hex encoding of an extension: beware experts only!
+# 1.2.3.5=RAW:02:03
+# You can even override a supported extension:
+# basicConstraints= critical, RAW:30:03:01:01:FF