*** empty log message ***

[openssl.git] / apps / openssl.cnf

diff --git a/apps/openssl.cnf b/apps/openssl.cnf
index e5e2eee56fdcff1a73e9595c594d0bb6d640eb9e..ac442a732b0cf64a43ed598199e2b31bf5a5d035 100644 (file)
--- a/apps/openssl.cnf
+++ b/apps/openssl.cnf
@@ -5,6 +5,15 @@
 
 RANDFILE               = $ENV::HOME/.rnd
 oid_file               = $ENV::HOME/.oid
+oid_section            = new_oids
+
+[ new_oids ]
+
+# We can add new OIDs in here for use by 'ca' and 'req'.
+# Add a simple OID like this:
+# testoid1=1.2.3.4
+# Or use config file substitution like this:
+# testoid2=${testoid1}.5.6
 
 ####################################################################
 [ ca ]
@@ -26,6 +35,7 @@ private_key   = $dir/private/cakey.pem# The private key
 RANDFILE       = $dir/private/.rand    # private random number file
 
 x509_extensions        = usr_cert              # The extentions to add to the cert
+crl_extensions = crl_ext               # Extensions to add to CRL
 default_days   = 365                   # how long to certify for
 default_crl_days= 30                   # how long before next CRL
 default_md     = md5                   # which md to use.
@@ -92,7 +102,7 @@ commonName_max                       = 64
 emailAddress                   = Email Address
 emailAddress_max               = 40
 
-SET-ex3                                = SET extension number 3
+# SET-ex3                      = SET extension number 3
 
 [ req_attributes ]
 challengePassword              = A challenge password
@@ -127,7 +137,18 @@ basicConstraints=CA:FALSE
 keyUsage = nonRepudiation, digitalSignature, keyEncipherment
 
 nsComment                      = "OpenSSL Generated Certificate"
+
+# PKIX recommendations
 subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+
+# Import the email address.
+
+subjectAltName=email:copy
+
+# Copy subject details
+
+issuerAltName=issuer:copy
 
 #nsCaRevocationUrl             = http://www.domain.dom/ca-crl.pem
 #nsBaseUrl
@@ -147,6 +168,8 @@ basicConstraints = CA:true
 
 subjectKeyIdentifier=hash
 
+authorityKeyIdentifier=keyid:always,issuer:always
+
 # This is what PKIX recommends but some broken software chokes on critical
 # extensions.
 #basicConstraints = critical,CA:true
@@ -157,7 +180,20 @@ keyUsage = cRLSign, keyCertSign
 # Some might want this also
 #nsCertType = sslCA, emailCA
 
+# Include email address in subject alt name: another PKIX recommendation
+subjectAltName=email:copy
+# Copy issuer details
+issuerAltName=issuer:copy
+
 # RAW DER hex encoding of an extension: beware experts only!
 # 1.2.3.5=RAW:02:03
 # You can even override a supported extension:
 # basicConstraints= critical, RAW:30:03:01:01:FF
+
+[ crl_ext ]
+
+# CRL extensions.
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
+
+issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always,issuer:always