Add signer configuration
This commit is contained in:
Jan Dittberner
parent
e8ad6b9ba7
commit
774c6b0e9c
23 changed files with 597 additions and 41 deletions
|
|
@ -8,6 +8,10 @@ cp /usr/local/etc/application/feed.rss /www/pages/index/feed.rss
|
|||
|
||||
make -C /www/locale
|
||||
|
||||
mkdir -p "$CSR_DIRECTORY" "$CRT_DIRECTORY"
|
||||
chown www-data "$CSR_DIRECTORY" "$CRT_DIRECTORY"
|
||||
chmod 0755 "$CSR_DIRECTORY" "$CRT_DIRECTORY"
|
||||
|
||||
apache2ctl start "$@"
|
||||
|
||||
exec tail -F --follow=name --retry /var/log/apache2/error.log /var/log/apache2/phperror.log
|
||||
|
|
|
|||
|
|
@ -8,6 +8,20 @@ sleep 1
|
|||
|
||||
export SERIAL_PORT=/dev/ttyUSB0
|
||||
|
||||
mkdir -p /srv/ca/CA/certs /srv/ca/CA/private /srv/ca/CA/newcerts
|
||||
cp /srv/testca/root/ca.crt.pem /srv/ca/CA/ca.crt.pem
|
||||
cp /srv/testca/root/private/ca.key.pem /srv/ca/CA/private/ca.key.pem
|
||||
if [ ! -f /srv/ca/CA/index.txt ]; then cp /srv/testca/root/index.txt /srv/ca/CA/index.txt; fi
|
||||
if [ ! -f /srv/ca/CA/serial ]; then echo 1 > /srv/ca/CA/serial; fi
|
||||
if [ ! -f /srv/ca/CA/crlnumber ]; then echo 1000 > /srv/ca/CA/crlnumber; fi
|
||||
|
||||
mkdir -p /srv/ca/class3/certs /srv/ca/class3/private /srv/ca/class3/newcerts
|
||||
cp /srv/testca/class3/ca.crt.pem /srv/ca/class3/ca.crt.pem
|
||||
cp /srv/testca/class3/private/ca.key.pem /srv/ca/class3/private/ca.key.pem
|
||||
if [ ! -f /srv/ca/class3/index.txt ]; then cp /srv/testca/class3/index.txt /srv/ca/class3/index.txt; fi
|
||||
if [ ! -f /srv/ca/class3/serial ]; then echo 1 > /srv/ca/class3/serial; fi
|
||||
if [ ! -f /srv/ca/class3/crlnumber ]; then echo 1000 > /srv/ca/class3/crlnumber; fi
|
||||
|
||||
cd /srv/CommModule/
|
||||
|
||||
touch server.pl-active
|
||||
|
|
|
|||
40
docker/signer-config/class3-client-codesign.cnf
Normal file
40
docker/signer-config/class3-client-codesign.cnf
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/class3 # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = optional
|
||||
emailAddress = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical, CA:FALSE
|
||||
nsComment = "To get your own certificate for FREE head over to http://www.CAcert.org"
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = emailProtection, clientAuth, codeSigning, msCodeInd, msCodeCom, msEFS, msSGC, nsSGC
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/test-class3-revoke.crl
|
||||
subjectAltName = email:copy
|
||||
|
||||
[ crl_ext ]
|
||||
40
docker/signer-config/class3-client-org.cnf
Normal file
40
docker/signer-config/class3-client-org.cnf
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/class3 # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = optional
|
||||
emailAddress = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical, CA:FALSE
|
||||
nsComment = "To get your own certificate for FREE head over to http://www.CAcert.org"
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = emailProtection, clientAuth, msEFS, msSGC, nsSGC
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
|
||||
subjectAltName = email:copy
|
||||
|
||||
[ crl_ext ]
|
||||
|
|
@ -1,23 +1,23 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/class3 # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
crlnumber = $dir/crlnumber # bug-1438
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
dir = /srv/ca/class3 # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
crlnumber = $dir/crlnumber # Where the current CRL-number is stored (bug-1438)
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
|
|
@ -37,3 +37,5 @@ extendedKeyUsage = emailProtection, clientAuth, msEFS, msSGC, nsSGC
|
|||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
|
||||
subjectAltName = email:copy
|
||||
|
||||
[ crl_ext ]
|
||||
38
docker/signer-config/class3-ocsp.cnf
Normal file
38
docker/signer-config/class3-ocsp.cnf
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/class3 # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = optional
|
||||
emailAddress = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical,CA:FALSE
|
||||
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
|
||||
extendedKeyUsage = serverAuth,OCSPSigning,nsSGC,msSGC
|
||||
# no authorityInfoAccess to avoid loops
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
|
||||
|
||||
[ crl_ext ]
|
||||
39
docker/signer-config/class3-server-org.cnf
Normal file
39
docker/signer-config/class3-server-org.cnf
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/class3 # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 180 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = optional
|
||||
subjectAltName = optional
|
||||
emailAddress = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical,CA:FALSE
|
||||
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
|
||||
extendedKeyUsage = clientAuth,serverAuth,nsSGC,msSGC
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
|
||||
|
||||
[ crl_ext ]
|
||||
34
docker/signer-config/class3-server.cnf
Normal file
34
docker/signer-config/class3-server.cnf
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/class3 # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
crlnumber = $dir/crlnumber # Where the current CRL-number is stored (bug-1438)
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 180 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
commonName = optional
|
||||
subjectAltName = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical,CA:FALSE
|
||||
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
|
||||
extendedKeyUsage = clientAuth,serverAuth,nsSGC,msSGC
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
|
||||
|
||||
[ crl_ext ]
|
||||
33
docker/signer-config/class3-subca.cnf
Normal file
33
docker/signer-config/class3-subca.cnf
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/class3 # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 180 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
commonName = optional
|
||||
subjectAltName = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical,CA:TRUE
|
||||
extendedKeyUsage = clientAuth,serverAuth,nsSGC,msSGC
|
||||
keyUsage = digitalSignature,keyEncipherment
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
|
||||
|
||||
[ crl_ext ]
|
||||
38
docker/signer-config/class3-timestamp.cnf
Normal file
38
docker/signer-config/class3-timestamp.cnf
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/class3 # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = optional
|
||||
emailAddress = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical,CA:FALSE
|
||||
extendedKeyUsage = clientAuth,serverAuth,timeStamping
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
|
||||
subjectAltName = email:copy
|
||||
|
||||
[ crl_ext ]
|
||||
40
docker/signer-config/openssl-client-codesign.cnf
Normal file
40
docker/signer-config/openssl-client-codesign.cnf
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/CA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = optional
|
||||
emailAddress = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical,CA:FALSE
|
||||
nsComment = "To get your own certificate for FREE head over to http://www.CAcert.org"
|
||||
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
|
||||
extendedKeyUsage = emailProtection,clientAuth,codeSigning,msCodeInd,msCodeCom,msEFS,msSGC,nsSGC
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
|
||||
subjectAltName = email:copy
|
||||
|
||||
[ crl_ext ]
|
||||
40
docker/signer-config/openssl-client-org.cnf
Normal file
40
docker/signer-config/openssl-client-org.cnf
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/CA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = optional
|
||||
emailAddress = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical,CA:FALSE
|
||||
nsComment = "To get your own certificate for FREE head over to http://www.CAcert.org"
|
||||
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
|
||||
extendedKeyUsage = emailProtection,clientAuth,msEFS,msSGC,nsSGC
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
|
||||
subjectAltName = email:copy
|
||||
|
||||
[ crl_ext ]
|
||||
|
|
@ -1,23 +1,23 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/CA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
crlnumber = $dir/crlnumber # bug-1438
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
dir = /srv/ca/CA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
crlnumber = $dir/crlnumber # bug-1438
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
|
|
@ -30,10 +30,12 @@ commonName = optional
|
|||
emailAddress = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical, CA:FALSE
|
||||
basicConstraints = critical,CA:FALSE
|
||||
nsComment = "To get your own certificate for FREE head over to http://www.CAcert.org"
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = emailProtection, clientAuth, msEFS, msSGC, nsSGC
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org
|
||||
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
|
||||
extendedKeyUsage = emailProtection,clientAuth,msEFS,msSGC,nsSGC
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
|
||||
subjectAltName = email:copy
|
||||
|
||||
[ crl_ext ]
|
||||
38
docker/signer-config/openssl-ocsp.cnf
Normal file
38
docker/signer-config/openssl-ocsp.cnf
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/CA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = optional
|
||||
emailAddress = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical,CA:FALSE
|
||||
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
|
||||
extendedKeyUsage = serverAuth,OCSPSigning,nsSGC,msSGC
|
||||
# no authorityInfoAccess to avoid loops
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
|
||||
|
||||
[ crl_ext ]
|
||||
39
docker/signer-config/openssl-server-org.cnf
Normal file
39
docker/signer-config/openssl-server-org.cnf
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/CA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = optional
|
||||
subjectAltName = optional
|
||||
emailAddress = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical,CA:FALSE
|
||||
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
|
||||
extendedKeyUsage = clientAuth,serverAuth,nsSGC,msSGC
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
|
||||
|
||||
[ crl_ext ]
|
||||
34
docker/signer-config/openssl-server.cnf
Normal file
34
docker/signer-config/openssl-server.cnf
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/CA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
crlnumber = $dir/crlnumber # Where the current CRL-number is stored (bug-1438)
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
commonName = optional
|
||||
subjectAltName = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical,CA:FALSE
|
||||
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
|
||||
extendedKeyUsage = clientAuth,serverAuth,nsSGC,msSGC
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
|
||||
|
||||
[ crl_ext ]
|
||||
34
docker/signer-config/openssl-subca.cnf
Normal file
34
docker/signer-config/openssl-subca.cnf
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/CA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
crlnumber = $dir/crlnumber # Where the current CRL-number is stored (bug-1438)
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
commonName = optional
|
||||
subjectAltName = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical,CA:TRUE
|
||||
extendedKeyUsage = clientAuth,serverAuth,nsSGC,msSGC
|
||||
keyUsage = digitalSignature,keyEncipherment
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
|
||||
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
|
||||
|
||||
[ crl_ext ]
|
||||
38
docker/signer-config/openssl-timestamp.cnf
Normal file
38
docker/signer-config/openssl-timestamp.cnf
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
[ CA_default ]
|
||||
dir = /srv/ca/CA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
crlnumber = $dir/crlnumber # Where the current CRL-number is stored (bug-1438)
|
||||
database = $dir/index.txt # database index file.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
certificate = $dir/ca.crt.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/ca.key.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
x509_extensions = usr_cert # The extentions to add to the cert
|
||||
default_days = 200 # how long to certify for
|
||||
default_crl_days = 30 # how long before next CRL
|
||||
default_md = sha512 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = optional
|
||||
emailAddress = optional
|
||||
|
||||
[ usr_cert ]
|
||||
basicConstraints = critical,CA:FALSE
|
||||
extendedKeyUsage = clientAuth,serverAuth,timeStamping
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
|
||||
subjectAltName = email:copy
|
||||
|
||||
[ crl_ext ]
|
||||
Loading…
Add table
Add a link
Reference in a new issue