| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091 |
- config_diagnostics = 1
- ####################################################################
- [ ca ]
- default_ca = Zi3_CA
- [ Zi3_CA ]
- dir = $ENV::CA_DIR # Where everything is kept
- new_certs_dir = $dir/certs # default place for new certs.
- certs = $dir/certs # Where the issued certs are kept
- crl_dir = $dir/db/crl # Where the issued crl are kept
- crlnumber = $crl_dir/number # the current crl number
- crl = $dir/db/crl/crl.pem # The current CRL
- database = $dir/db/index.txt # database index file.
- serial = $dir/db/serial # The current serial number
- certificate = $dir/ca.pem # The CA certificate
- private_key = $dir/keys/ca.key # The private key
- name_opt = ca_default # Subject Name options
- cert_opt = ca_default # Certificate field options
- default_days = 1825 # how long to certify for
- default_crl_days= 30 # how long before next CRL
- default_md = default # use public key default MD
- preserve = no # keep passed DN ordering
- x509_extensions = usr_cert # The extensions to add to the cert
- crl_extensions = crl_ext # The extensiont to add to CRL certs
- policy = policy_root # CA must match everything, must supply email
- [ policy_root ]
- organizationName = match
- organizationalUnitName = match
- commonName = supplied
- emailAddress = supplied
- [ policy_inter ]
- organizationName = match
- organizationalUnitName = supplied
- commonName = supplied
- emailAddress = optional
- [ policy_req ]
- organizationName = match
- organizationalUnitName = match
- commonName = supplied
- emailAddress = optional
- [ v3_ca ]
- subjectKeyIdentifier = hash
- authorityKeyIdentifier = keyid:always, issuer
- basicConstraints = critical, CA:true
- keyUsage = cRLSign, keyCertSign
- subjectAltName = email:copy
- [ v3_intermediate_ca ]
- subjectKeyIdentifier = hash
- authorityKeyIdentifier = keyid:always,issuer
- basicConstraints = critical, CA:true, pathlen:0
- keyUsage = critical, digitalSignature, cRLSign, keyCertSign
- subjectAltName = email:copy
- [ v3_req ]
- basicConstraints = CA:FALSE
- keyUsage = nonRepudiation, digitalSignature, keyEncipherment
- [ crl_ext ]
- authorityKeyIdentifier = keyid:always
- [ usr_cert ]
- basicConstraints = CA:FALSE
- #extendedKeyUsage = critical, timeStamping
- subjectKeyIdentifier = hash
- authorityKeyIdentifier = keyid:always,issuer
- issuerAltName = issuer:copy
- subjectAltName = email:move
- ####################################################################
- [ req ]
- default_bits = 4096
- default_keyfile = key.pem
- distinguished_name = req_distinguished_name
- #attributes = req_attributes
- x509_extensions = v3_ca
- string_mask = utf8only
- [ req_distinguished_name ]
- 0.organizationName = Organization
- 0.organizationName_default = Zi3
- organizationalUnitName = Service
- organizationalUnitName_default = Testing
- commonName = Common Name (e.g. server FQDN or YOUR name)
- commonName_max = 64
- emailAddress = Email Address
- emailAddress_max = 64
|
