-
Notifications
You must be signed in to change notification settings - Fork 1
/
openssl.cnf
73 lines (56 loc) · 2.31 KB
/
openssl.cnf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
# basic OpenSSL CA config
HOME = .
[ ca ]
default_ca = CA_default
[ CA_default ]
dir = ./certs
serial = $dir/serial
database = $dir/index.txt
new_certs_dir = $dir/newcerts
certificate = $dir/root.crt
private_key = $dir/root.key
default_days = 3650
default_md = sha512
preserve = no # whether keep DN ordering
email_in_dn = no
nameopt = default_ca
certopt = default_ca
policy = policy_match
crlnumber = $dir/crlnumber # the current crl number
crl = $dir/crl.pem # The current CRL
default_crl_days = 3650 # how long before next CRL
RANDFILE = $dir/.rand # private random number file
copy_extensions = copy # Honor extensions requested of us
[ req ]
default_days = 3650 # May not work, so also on command-line
default_bits = 4096 # Size of keys
default_keyfile = key.pem # name of generated keys
default_md = sha256 # message digest algorithm
string_mask = utf8only # permitted characters
distinguished_name = req_distinguished_name
req_extensions = v3_req
[ req_distinguished_name ]
commonName_default = ${ENV::SUBJECT_ALT_NAME}
[ v3_req ]
basicConstraints = critical,CA:FALSE
subjectKeyIdentifier = hash
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = critical,serverAuth, clientAuth
subjectAltName = critical,DNS:${ENV::SUBJECT_ALT_NAME},DNS:www.${ENV::SUBJECT_ALT_NAME},IP:${ENV::SUBJECT_ALT_IP},email:move
[ v3_ca ]
basicConstraints = critical,CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
keyUsage = cRLSign, keyCertSign
issuerAltName = issuer:copy
subjectAltName = critical,DNS:${ENV::SUBJECT_ALT_NAME},email:move
[ policy_match ]
countryName = optional
stateOrProvinceName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ crl_ext ] # CRL extensions.
issuerAltName = issuer:copy
authorityKeyIdentifier = keyid:always,issuer:always