130 lines
5.4 KiB
Plaintext
130 lines
5.4 KiB
Plaintext
# Simple Signing CA
|
|
|
|
# The [default] section contains global constants that can be referred to from
|
|
# the entire configuration file. It may also hold settings pertaining to more
|
|
# than one openssl command.
|
|
|
|
[ default ]
|
|
ca = kopano-ca # CA name
|
|
dir = . # Top dir
|
|
|
|
# The next part of the configuration file is used by the openssl req command.
|
|
# It defines the CA's key pair, its DN, and the desired extensions for the CA
|
|
# certificate.
|
|
|
|
[ req_ca ]
|
|
default_bits = 2048 # RSA key size
|
|
encrypt_key = yes # Protect private key
|
|
default_md = sha256 # MD to use
|
|
utf8 = yes # Input is UTF-8
|
|
string_mask = utf8only # Emit UTF-8 strings
|
|
prompt = no # Don't prompt for DN
|
|
distinguished_name = ca_dn # DN section
|
|
req_extensions = ca_reqext # Desired extensions
|
|
|
|
[ ca_dn ]
|
|
0.domainComponent = "de"
|
|
1.domainComponent = "dts"
|
|
organizationName = "Digital Trust Solutions"
|
|
organizationalUnitName = "Information Security Unit"
|
|
commonName = "DTS Signing CA"
|
|
countryName = DE
|
|
stateOrProvinceName = Hesse
|
|
localityName = Frankfurt/Main
|
|
emailAddress = andreas@baloghs.de
|
|
# /DC=de/DC=dts/O=Digital Trust Solutions/OU=Information Security Unit+CN=DTS Signing CA/
|
|
|
|
[ ca_reqext ]
|
|
keyUsage = critical,keyCertSign,cRLSign
|
|
basicConstraints = critical,CA:true,pathlen:0
|
|
subjectKeyIdentifier = hash
|
|
|
|
[ req ]
|
|
default_bits = 2048 # RSA key size
|
|
encrypt_key = yes # Protect private key
|
|
default_md = sha256 # MD to use
|
|
utf8 = yes # Input is UTF-8
|
|
string_mask = utf8only # Emit UTF-8 strings
|
|
prompt = no # Don't prompt for DN
|
|
distinguished_name = server_dn # DN section
|
|
req_extensions = server_reqext # Desired extensions
|
|
|
|
[ server_dn ]
|
|
0.domainComponent = "de"
|
|
1.domainComponent = "dts"
|
|
organizationName = "Digital Trust Solutions"
|
|
organizationalUnitName = "Information Security Unit"
|
|
commonName = $ENV::CN
|
|
countryName = DE
|
|
stateOrProvinceName = Hesse
|
|
localityName = Frankfurt/Main
|
|
emailAddress = andreas@baloghs.de
|
|
|
|
[ server_reqext ]
|
|
keyUsage = critical,digitalSignature,keyEncipherment
|
|
extendedKeyUsage = serverAuth,clientAuth
|
|
subjectKeyIdentifier = hash
|
|
subjectAltName = $ENV::SAN
|
|
|
|
# The remainder of the configuration file is used by the openssl ca command.
|
|
# The CA section defines the locations of CA assets, as well as the policies
|
|
# applying to the CA.
|
|
|
|
[ ca ]
|
|
default_ca = signing_ca # The default CA section
|
|
|
|
[ signing_ca ]
|
|
certificate = $dir/certs/$ca.crt # The CA cert
|
|
private_key = $dir/certs/$ca.key # CA private key
|
|
new_certs_dir = $dir/db # Certificate archive
|
|
serial = $dir/db/$ca.crt.srl # Serial number file
|
|
crlnumber = $dir/db/$ca.crl.srl # CRL number file
|
|
database = $dir/db/$ca.db # Index file
|
|
unique_subject = no # Require unique subject
|
|
default_days = 3652 # How long to certify for
|
|
default_md = sha256 # MD to use
|
|
policy = match_pol # Default naming policy
|
|
email_in_dn = no # Add email to cert DN
|
|
preserve = no # Keep passed DN ordering
|
|
name_opt = ca_default # Subject DN display options
|
|
cert_opt = ca_default # Certificate display options
|
|
copy_extensions = copy # Copy extensions from CSR
|
|
x509_extensions = server_ext # Default cert extensions
|
|
default_crl_days = 7 # How long before next CRL
|
|
crl_extensions = crl_ext # CRL extensions
|
|
|
|
# Naming policies control which parts of a DN end up in the certificate and
|
|
# under what circumstances certification should be denied.
|
|
|
|
[ match_pol ]
|
|
domainComponent = match # Must match 'simple.org'
|
|
organizationName = match # Must match 'Simple Inc'
|
|
organizationalUnitName = optional # Included if present
|
|
commonName = supplied # Must be present
|
|
|
|
[ any_pol ]
|
|
domainComponent = optional
|
|
countryName = optional
|
|
stateOrProvinceName = optional
|
|
localityName = optional
|
|
organizationName = optional
|
|
organizationalUnitName = optional
|
|
commonName = optional
|
|
emailAddress = optional
|
|
|
|
# Certificate extensions define what types of certificates the CA is able to
|
|
# create.
|
|
|
|
[ signing_ca_ext ]
|
|
keyUsage = critical,keyCertSign,cRLSign
|
|
basicConstraints = critical,CA:true,pathlen:0
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid:always
|
|
|
|
[ server_ext ]
|
|
keyUsage = critical,digitalSignature,keyEncipherment
|
|
basicConstraints = CA:false
|
|
extendedKeyUsage = serverAuth,clientAuth
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid:always
|