2 # OpenSSL example configuration file.
3 # See doc/man5/config.pod for more info.
5 # This is mostly being used for generation of certificate requests,
6 # but may be used for auto loading of providers
8 # Note that you can include other files from the main configuration
9 # file using the .include directive.
12 # This definition stops the following lines choking if HOME isn't
16 # Use this in order to automatically load providers.
17 openssl_conf = openssl_init
19 # Extra OBJECT IDENTIFIER info:
20 # oid_file = $ENV::HOME/.oid
21 oid_section = new_oids
23 # To use this configuration file with the "-extfile" option of the
24 # "openssl x509" utility, name here the section containing the
25 # X.509v3 extensions to use:
27 # (Alternatively, use a configuration file that has only
28 # X.509v3 extensions in its main [= default] section.)
31 # We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
32 # Add a simple OID like this:
34 # Or use config file substitution like this:
35 # testoid2=${testoid1}.5.6
37 # Policies used by the TSA examples.
38 tsa_policy1 = 1.2.3.4.1
39 tsa_policy2 = 1.2.3.4.5.6
40 tsa_policy3 = 1.2.3.4.5.7
43 # Optionally include a file that is generated by the OpenSSL fipsinstall
44 # application. This file contains configuration data required by the OpenSSL
45 # fips provider. It contains a named section e.g. [fips_sect] which is
46 # referenced from the [provider_sect] below.
47 # Refer to the OpenSSL security policy for more information.
48 # .include fipsmodule.cnf
51 providers = provider_sect
53 # List of providers to load
55 default = default_sect
56 # The fips section name should match the section name inside the
57 # included fipsmodule.cnf.
64 ####################################################################
66 default_ca = CA_default # The default ca section
68 ####################################################################
71 dir = sys\$disk:[.demoCA # Where everything is kept
72 certs = $dir.certs] # Where the issued certs are kept
73 crl_dir = $dir.crl] # Where the issued crl are kept
74 database = $dir]index.txt # database index file.
75 #unique_subject = no # Set to 'no' to allow creation of
76 # several certs with same subject.
77 new_certs_dir = $dir.newcerts] # default place for new certs.
79 certificate = $dir]cacert.pem # The CA certificate
80 serial = $dir]serial. # The current serial number
81 crlnumber = $dir]crlnumber. # the current crl number
82 # must be commented out to leave a V1 CRL
83 crl = $dir]crl.pem # The current CRL
84 private_key = $dir.private]cakey.pem# The private key
86 x509_extensions = usr_cert # The extensions to add to the cert
88 # Comment out the following two lines for the "traditional"
89 # (and highly broken) format.
90 name_opt = ca_default # Subject Name options
91 cert_opt = ca_default # Certificate field options
93 # Extension copying option: use with caution.
94 # copy_extensions = copy
96 # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
97 # so this is commented out by default to leave a V1 CRL.
98 # crlnumber must also be commented out to leave a V1 CRL.
99 # crl_extensions = crl_ext
101 default_days = 365 # how long to certify for
102 default_crl_days= 30 # how long before next CRL
103 default_md = default # use public key default MD
104 preserve = no # keep passed DN ordering
106 # A few difference way of specifying how similar the request should look
107 # For type CA, the listed attributes must be the same, and the optional
108 # and supplied fields are just that :-)
109 policy = policy_match
114 stateOrProvinceName = match
115 organizationName = match
116 organizationalUnitName = optional
117 commonName = supplied
118 emailAddress = optional
120 # For the 'anything' policy
121 # At this point in time, you must list all acceptable 'object'
124 countryName = optional
125 stateOrProvinceName = optional
126 localityName = optional
127 organizationName = optional
128 organizationalUnitName = optional
129 commonName = supplied
130 emailAddress = optional
132 ####################################################################
135 default_keyfile = privkey.pem
136 distinguished_name = req_distinguished_name
137 attributes = req_attributes
138 x509_extensions = v3_ca # The extensions to add to the self signed cert
140 # Passwords for private keys if not present they will be prompted for
141 # input_password = secret
142 # output_password = secret
144 # This sets a mask for permitted string types. There are several options.
145 # default: PrintableString, T61String, BMPString.
146 # pkix : PrintableString, BMPString (PKIX recommendation before 2004)
147 # utf8only: only UTF8Strings (PKIX recommendation after 2004).
148 # nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
149 # MASK:XXXX a literal mask value.
150 # WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
151 string_mask = utf8only
153 # req_extensions = v3_req # The extensions to add to a certificate request
155 [ req_distinguished_name ]
156 countryName = Country Name (2 letter code)
157 countryName_default = AU
161 stateOrProvinceName = State or Province Name (full name)
162 stateOrProvinceName_default = Some-State
164 localityName = Locality Name (eg, city)
166 0.organizationName = Organization Name (eg, company)
167 0.organizationName_default = Internet Widgits Pty Ltd
169 # we can do this but it is not needed normally :-)
170 #1.organizationName = Second Organization Name (eg, company)
171 #1.organizationName_default = World Wide Web Pty Ltd
173 organizationalUnitName = Organizational Unit Name (eg, section)
174 #organizationalUnitName_default =
176 commonName = Common Name (e.g. server FQDN or YOUR name)
179 emailAddress = Email Address
180 emailAddress_max = 64
182 # SET-ex3 = SET extension number 3
185 challengePassword = A challenge password
186 challengePassword_min = 4
187 challengePassword_max = 20
189 unstructuredName = An optional company name
193 # These extensions are added when 'ca' signs a request.
195 # This goes against PKIX guidelines but some CAs do it and some software
196 # requires this to avoid interpreting an end user certificate as a CA.
198 basicConstraints=CA:FALSE
200 # This is typical in keyUsage for a client certificate.
201 # keyUsage = nonRepudiation, digitalSignature, keyEncipherment
203 # PKIX recommendations harmless if included in all certificates.
204 subjectKeyIdentifier=hash
205 authorityKeyIdentifier=keyid,issuer
207 # This stuff is for subjectAltName and issuerAltname.
208 # Import the email address.
209 # subjectAltName=email:copy
210 # An alternative to produce certificates that aren't
211 # deprecated according to PKIX.
212 # subjectAltName=email:move
214 # Copy subject details
215 # issuerAltName=issuer:copy
217 # This is required for TSA certificates.
218 # extendedKeyUsage = critical,timeStamping
222 # Extensions to add to a certificate request
224 basicConstraints = CA:FALSE
225 keyUsage = nonRepudiation, digitalSignature, keyEncipherment
230 # Extensions for a typical CA
233 # PKIX recommendation.
235 subjectKeyIdentifier=hash
237 authorityKeyIdentifier=keyid:always,issuer
239 basicConstraints = critical,CA:true
241 # Key usage: this is typical for a CA certificate. However since it will
242 # prevent it being used as an test self-signed certificate it is best
243 # left out by default.
244 # keyUsage = cRLSign, keyCertSign
246 # Include email address in subject alt name: another PKIX recommendation
247 # subjectAltName=email:copy
248 # Copy issuer details
249 # issuerAltName=issuer:copy
251 # DER hex encoding of an extension: beware experts only!
253 # Where 'obj' is a standard or added object
254 # You can even override a supported extension:
255 # basicConstraints= critical, DER:30:03:01:01:FF
260 # Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
262 # issuerAltName=issuer:copy
263 authorityKeyIdentifier=keyid:always
266 # These extensions should be added when creating a proxy certificate
268 # This goes against PKIX guidelines but some CAs do it and some software
269 # requires this to avoid interpreting an end user certificate as a CA.
271 basicConstraints=CA:FALSE
273 # This is typical in keyUsage for a client certificate.
274 # keyUsage = nonRepudiation, digitalSignature, keyEncipherment
276 # PKIX recommendations harmless if included in all certificates.
277 subjectKeyIdentifier=hash
278 authorityKeyIdentifier=keyid,issuer
280 # This stuff is for subjectAltName and issuerAltname.
281 # Import the email address.
282 # subjectAltName=email:copy
283 # An alternative to produce certificates that aren't
284 # deprecated according to PKIX.
285 # subjectAltName=email:move
287 # Copy subject details
288 # issuerAltName=issuer:copy
290 # This really needs to be in place for it to be a proxy certificate.
291 proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
293 ####################################################################
296 default_tsa = tsa_config1 # the default TSA section
300 # These are used by the TSA reply generation only.
301 dir = sys\$disk:[.demoCA # TSA root directory
302 serial = $dir]tsaserial. # The current serial number (mandatory)
303 crypto_device = builtin # OpenSSL engine to use for signing
304 signer_cert = $dir/tsacert.pem # The TSA signing certificate
306 certs = $dir.cacert.pem] # Certificate chain to include in reply
308 signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
309 signer_digest = sha256 # Signing digest to use. (Optional)
310 default_policy = tsa_policy1 # Policy if request did not specify it
312 other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
313 digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory)
314 accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
315 clock_precision_digits = 0 # number of digits after dot. (optional)
316 ordering = yes # Is ordering defined for timestamps?
317 # (optional, default: no)
318 tsa_name = yes # Must the TSA name be included in the reply?
319 # (optional, default: no)
320 ess_cert_id_chain = no # Must the ESS cert id chain be included?
321 # (optional, default: no)
322 ess_cert_id_alg = sha1 # algorithm to compute certificate
323 # identifier (optional, default: sha1)
325 [insta] # CMP using Insta Demo CA
327 server = pki.certificate.fi:8700
328 # proxy = # set this as far as needed, e.g., http://192.168.1.1:8080
332 # Server authentication
333 recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
334 ignore_keyusage = 1 # potentially needed quirk
335 unprotected_errors = 1 # potentially needed quirk
336 extracertsout = insta.extracerts.pem
338 # Client authentication
339 ref = 3078 # user identification
340 secret = pass:insta # can be used for both client and server side
342 # Generic message options
343 cmd = ir # default operation, can be overridden on cmd line with, e.g., kur
345 # Certificate enrollment
346 subject = "/CN=openssl-cmp-test"
347 newkey = insta.priv.pem
348 out_trusted = insta.ca.crt
349 certout = insta.cert.pem
351 [pbm] # Password-based protection for Insta CA
352 # Server and client authentication
353 ref = $insta::ref # 3078
354 secret = $insta::secret # pass:insta
356 [signature] # Signature-based protection for Insta CA
357 # Server authentication
358 trusted = insta.ca.crt # does not include keyUsage digitalSignature
360 # Client authentication
361 secret = # disable PBM
362 key = $insta::newkey # insta.priv.pem
363 cert = $insta::certout # insta.cert.pem
374 oldcert = $insta::certout # insta.cert.pem
377 # Certificate revocation
379 oldcert = $insta::certout # insta.cert.pem