ca_openssl.cfg

# $Id$
#
# OpenSSL configuration file for custom Certificate Authority. Use a
# different openssl.cnf file to generate certificate signing requests;
# this one is for use only in Certificate Authority operations (csr ->
# cert, cert revocation, revocation list generation).
#
# Be sure to customize this file prior to use, e.g. the commonName and
# other options under the root_ca_distinguished_name section.
#
# http://sial.org/howto/openssl/ca/
# http://www.openssl.org/docs/apps/ca.html

HOME                    = $ENV::CERT_AUTHORITY_HOME
RANDFILE                = $ENV::HOME/.rnd


##############################
##  Configuration Sections  ##
##############################

# Certificate Authority Section
[ ca ]
default_ca = root_ca


[ root_ca ]
rootdir                   = $ENV::CERT_AUTHORITY_HOME
certs                     = $rootdir/certs                            # Where the issued certs are kept
crl_dir                   = $rootdir/crl                              # Where the issued CRL are kept
database                  = $rootdir/database/root/index.txt          # Database index file
unique_subject            = no                                        # Allow creation of several ctificates with same subject
new_certs_dir             = $rootdir/newcerts                         # Default place for new certs.
certificate               = $rootdir/certs/root_ca.pem                # The CA Certificate (Public Key)
serial                    = $rootdir/database/root/serial             # The current serial number
crlnumber                 = $rootdir/database/root/crlnumber          # CRL Serial Number
crl                       = $rootdir/crl/root_ca.crl                  # The current CRL
private_key               = $rootdir/private/root_ca.pem              # The CA Private key
RANDFILE                  = $rootdir/private/.rand                    # Private random number file
default_days              = 5840                                      # How long to certify for (16 years)
default_crl_days          = 30                                        # How long before next CRL (1 year)
default_md                = sha256                                    # Which Hash function to use
preserve                  = true                                      # Keep passed DN ordering
policy                    = policy_match                              # Policy for CA only (this can be overridden by the "-policy" option)


[ intermediate_ca ]
rootdir                   = $ENV::CERT_AUTHORITY_HOME
certs                     = $rootdir/certs                              # Where the issued certs are kept
crl_dir                   = $rootdir/crl                                # Where the issued CRL are kept
database                  = $rootdir/database/intermediate/index.txt    # Database index file
unique_subject            = no                                          # Allow creation of several ctificates with same subject
new_certs_dir             = $rootdir/newcerts                           # Default place for new certs.
certificate               = $rootdir/certs/intermediate_ca.pem          # The CA Certificate (Public Key)
serial                    = $rootdir/database/intermediate/serial       # The current serial number
crlnumber                 = $rootdir/database/intermediate/crlnumber    # CRL Serial Number
crl                       = $rootdir/crl/intermediate_ca.crl            # The current CRL
private_key               = $rootdir/private/intermediate_ca.pem        # The CA Private key
RANDFILE                  = $rootdir/private/.rand                      # Private random number file
default_days              = 5840                                        # How long to certify for (16 years)
default_crl_days          = 30                                          # How long before next CRL (1 year)
default_md                = sha256                                      # Which Hash function to use
preserve                  = true                                        # Keep passed DN ordering
policy                    = policy_match                                # Policy for CA only (this can be overridden by the "-policy" option)
email_in_dn               = no
# copy_extensions         = copy                                        # Copy requested extensions in CSR to issued certificate (Dangerous but convenient)

[ req ]
rootdir                   = $ENV::CERT_AUTHORITY_HOME
default_bits              = 2048
default_md                = sha256                                      # Which Hash function to use
prompt                    = no
encrypt_key               = no                                          # Disable Key Encryption, THIS IS NOT SECURE AS SHOULD NOT BE USED IN PRODUCTION
distinguished_name        = req_distinguished_name
# attributes              = req_attributes                              # Disabled, passed as command-line argument to support multiple templates
# x509_extensions         = req_extensions                              # Disabled, passed as command-line argument to support multiple templates

# Passwords for private keys if not present they will be prompted for
# Passwords are disabled for Unit Test using encrypt_key = no
# input_password = Chang3M3F0rPr0d!
# output_password = Chang3M3F0rPr0d!

# Challenge password section (Disabled)
# [ req_attributes ]
# challengePassword       = A challenge password (between 6 and 20 characters)
# challengePassword_min   = 6
# challengePassword_max   = 20

[ req_distinguished_name ]
commonName = $ENV::CSR_COMMON_NAME
organizationalUnitName = $ENV::CSR_ORGANIZATIONAL_UNIT_NAME
organizationName = $ENV::CSR_ORGANIZATION_NAME
localityName = $ENV::CSR_LOCALITY_NAME
stateOrProvinceName = $ENV::CSR_STATE_OR_PROVINCE_NAME
countryName = US

[ ca_extensions ]
basicConstraints          = critical, CA:true, pathlen:1
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always
keyUsage                  = critical, cRLSign, keyCertSign, digitalSignature


[ intermediate_extensions ]
basicConstraints          = critical, CA:true, pathlen:0
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/root_ca.crt
crlDistributionPoints     = URI:${ENV::CA_CRL_URL}/root_ca.crl
keyUsage                  = critical, cRLSign, keyCertSign, digitalSignature

[ intermediate_extensions_no_crl ]
basicConstraints          = critical, CA:true, pathlen:0
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
keyUsage                  = critical, cRLSign, keyCertSign, digitalSignature

[ server_auth_extensions ]
basicConstraints          = critical, CA:false
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/intermediate_ca.crt
crlDistributionPoints     = URI:${ENV::CA_CRL_URL}/intermediate_ca.crl
keyUsage                  = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage          = critical, serverAuth

[ server_auth_extensions_no_crl ]
basicConstraints          = critical, CA:false
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/intermediate_ca.crt
keyUsage                  = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage          = critical, serverAuth

[ server_auth_san_extensions ]
basicConstraints          = critical, CA:false
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/intermediate_ca.crt
crlDistributionPoints     = URI:${ENV::CA_CRL_URL}/intermediate_ca.crl
keyUsage                  = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage          = critical, serverAuth
subjectAltName            = $ENV::CSR_SUBJECT_ALT_NAME

[ server_auth_san_extensions_no_crl ]
basicConstraints          = critical, CA:false
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/intermediate_ca.crt
keyUsage                  = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage          = critical, serverAuth
subjectAltName            = $ENV::CSR_SUBJECT_ALT_NAME

[ client_auth_extensions ]
basicConstraints          = critical, CA:false
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/intermediate_ca.crt
crlDistributionPoints     = URI:${ENV::CA_CRL_URL}/intermediate_ca.crl
keyUsage                  = critical, digitalSignature, nonRepudiation
extendedKeyUsage          = critical, clientAuth

[ client_auth_extensions_no_crl ]
basicConstraints          = critical, CA:false
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/intermediate_ca.crt
keyUsage                  = critical, digitalSignature, nonRepudiation
extendedKeyUsage          = critical, clientAuth

[ client_auth_email_extensions ]
basicConstraints          = critical, CA:false
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/intermediate_ca.crt
crlDistributionPoints     = URI:${ENV::CA_CRL_URL}/intermediate_ca.crl
keyUsage                  = critical, digitalSignature, nonRepudiation
extendedKeyUsage          = critical, emailProtection, clientAuth
subjectAltName            = email:$ENV::CSR_EMAIL

[ client_auth_email_extensions_no_crl ]
basicConstraints          = critical, CA:false
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/intermediate_ca.crt
keyUsage                  = critical, digitalSignature, nonRepudiation
extendedKeyUsage          = critical, emailProtection, clientAuth
subjectAltName            = email:$ENV::CSR_EMAIL

[ client_auth_smartcard_extensions ]
basicConstraints          = critical, CA:false
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/intermediate_ca.crt
crlDistributionPoints     = URI:${ENV::CA_CRL_URL}/intermediate_ca.crl
keyUsage                  = critical, digitalSignature, nonRepudiation
extendedKeyUsage          = critical, clientAuth, 1.3.6.1.4.1.311.20.2.2
subjectAltName            = otherName:1.3.6.1.4.1.311.20.2.3;UTF8:$ENV::CSR_USER_PRINCIPAL_NAME

[ client_auth_smartcard_extensions_no_crl ]
basicConstraints          = critical, CA:false
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/intermediate_ca.crt
keyUsage                  = critical, digitalSignature, nonRepudiation
extendedKeyUsage          = critical, clientAuth, 1.3.6.1.4.1.311.20.2.2
subjectAltName            = otherName:1.3.6.1.4.1.311.20.2.3;UTF8:$ENV::CSR_USER_PRINCIPAL_NAME

[ client_auth_all_extensions ]
basicConstraints          = critical, CA:false
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/intermediate_ca.crt
crlDistributionPoints     = URI:${ENV::CA_CRL_URL}/intermediate_ca.crl
keyUsage                  = critical, digitalSignature, nonRepudiation
extendedKeyUsage          = critical, emailProtection, clientAuth, 1.3.6.1.4.1.311.20.2.2
subjectAltName            = otherName:1.3.6.1.4.1.311.20.2.3;UTF8:$ENV::CSR_USER_PRINCIPAL_NAME, email:$ENV::CSR_EMAIL

[ client_auth_all_extensions_no_crl ]
basicConstraints          = critical, CA:false
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/intermediate_ca.crt
keyUsage                  = critical, digitalSignature, nonRepudiation
extendedKeyUsage          = critical, emailProtection, clientAuth, 1.3.6.1.4.1.311.20.2.2
subjectAltName            = otherName:1.3.6.1.4.1.311.20.2.3;UTF8:$ENV::CSR_USER_PRINCIPAL_NAME, email:$ENV::CSR_EMAIL

[ invalid_basic_contraint_extensions ]
basicConstraints          = critical, CA:true
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
authorityInfoAccess       = caIssuers;URI:${ENV::CA_AIA_URL}/intermediate_ca.crt
crlDistributionPoints     = URI:${ENV::CA_CRL_URL}/intermediate_ca.crl
keyUsage                  = critical, digitalSignature, nonRepudiation
extendedKeyUsage          = critical

[ invalid_basic_contraint_extensions_no_crl ]
basicConstraints          = critical, CA:true
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
keyUsage                  = critical, digitalSignature, nonRepudiation
extendedKeyUsage          = critical


# SET-ex3                 = SET extension number 3

#######################
##  Policy Sections  ##
#######################

# For the CA only
[ policy_match ]
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = match
commonName              = supplied
emailAddress            = optional

# For every certificate (Public Key)
[ policy_anything ]
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

# End File