55 lines
1.3 KiB
INI
55 lines
1.3 KiB
INI
ID=1
|
|
CA_DIR=out
|
|
|
|
[ca]
|
|
default_ca = ca_settings
|
|
preserve = yes
|
|
|
|
[ca_settings]
|
|
dir = ${ENV::CA_DIR}
|
|
database = $dir/${ENV::ID}-index.txt
|
|
new_certs_dir = $dir
|
|
serial = $dir/${ENV::ID}-serial
|
|
certificate = $dir/${ENV::ID}.pem
|
|
private_key = $dir/${ENV::ID}.key
|
|
RANDFILE = $dir/rand
|
|
default_md = sha256
|
|
default_days = 3650
|
|
policy = policy_anything
|
|
unique_subject = no
|
|
copy_extensions = copy
|
|
|
|
[policy_anything]
|
|
# Default signing policy
|
|
countryName = optional
|
|
stateOrProvinceName = optional
|
|
localityName = optional
|
|
organizationName = optional
|
|
organizationalUnitName = optional
|
|
commonName = optional
|
|
emailAddress = optional
|
|
|
|
[req]
|
|
default_bits = 2048
|
|
default_md = sha256
|
|
string_mask = utf8only
|
|
prompt = no
|
|
encrypt_key = no
|
|
distinguished_name = req_env_dn
|
|
|
|
[user_cert]
|
|
# Extensions to add when signing a request for an EE cert
|
|
basicConstraints = critical, CA:false
|
|
extendedKeyUsage = serverAuth,clientAuth
|
|
|
|
[san_user_cert]
|
|
subjectAltName = email:santest@example.com,otherName:msUPN;UTF8:santest@ad.corp.example.com
|
|
|
|
[ca_cert]
|
|
# Extensions to add when signing a request for an intermediate/CA cert
|
|
basicConstraints = critical, CA:true
|
|
keyUsage = critical, keyCertSign, cRLSign
|
|
|
|
[req_env_dn]
|
|
CN = ${ENV::COMMON_NAME}
|