| # | |
| # OpenSSL example configuration file for automated certificate creation. | |
| # | |
| # This definition stops the following lines choking if HOME or CN | |
| # is undefined. | |
| HOME = . | |
| RANDFILE = $ENV::HOME/.rnd | |
| CN = "Not Defined" | |
| default_ca = ca | |
| #################################################################### | |
| [ req ] | |
| default_bits = 2048 | |
| default_keyfile = privkey.pem | |
| # Don't prompt for fields: use those in section directly | |
| prompt = no | |
| distinguished_name = req_distinguished_name | |
| x509_extensions = v3_ca # The extensions to add to the self signed cert | |
| string_mask = utf8only | |
| # req_extensions = v3_req # The extensions to add to a certificate request | |
| [ req_distinguished_name ] | |
| countryName = UK | |
| organizationName = OpenSSL Group | |
| # Take CN from environment so it can come from a script. | |
| commonName = $ENV::CN | |
| [ usr_cert ] | |
| # These extensions are added when 'ca' signs a request for an end entity | |
| # certificate | |
| basicConstraints=critical, CA:FALSE | |
| keyUsage=critical, nonRepudiation, digitalSignature, keyEncipherment | |
| # PKIX recommendations harmless if included in all certificates. | |
| subjectKeyIdentifier=hash | |
| authorityKeyIdentifier=keyid | |
| [ dh_cert ] | |
| # These extensions are added when 'ca' signs a request for an end entity | |
| # DH certificate | |
| basicConstraints=critical, CA:FALSE | |
| keyUsage=critical, keyAgreement | |
| # PKIX recommendations harmless if included in all certificates. | |
| subjectKeyIdentifier=hash | |
| authorityKeyIdentifier=keyid | |
| [ v3_ca ] | |
| # Extensions for a typical CA | |
| # PKIX recommendation. | |
| subjectKeyIdentifier=hash | |
| authorityKeyIdentifier=keyid:always | |
| basicConstraints = critical,CA:true | |
| keyUsage = critical, cRLSign, keyCertSign | |