Implement CRL numbers.

[openssl.git] / apps / openssl.cnf

diff --git a/apps/openssl.cnf b/apps/openssl.cnf
index 2696044cf1d9bf0d028f5d6fd79e7e6c28544abe..8941f454f8a577d088f5628772498a75e2f21e54 100644 (file)
--- a/apps/openssl.cnf
+++ b/apps/openssl.cnf
@@ -44,6 +44,8 @@ new_certs_dir = $dir/newcerts         # default place for new certs.
 
 certificate    = $dir/cacert.pem       # The CA certificate
 serial         = $dir/serial           # The current serial number
+crlnumber      = $dir/crlnumber        # the current crl number
+                                       # must be commented out to leave a V1 CRL
 crl            = $dir/crl.pem          # The current CRL
 private_key    = $dir/private/cakey.pem# The private key
 RANDFILE       = $dir/private/.rand    # private random number file
@@ -60,6 +62,7 @@ cert_opt      = ca_default            # Certificate field options
 
 # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
 # so this is commented out by default to leave a V1 CRL.
+# crlnumber must also be commented out to leave a V1 CRL.
 # crl_extensions       = crl_ext
 
 default_days   = 365                   # how long to certify for