Add signer configuration

This commit is contained in:
Jan Dittberner 2020-12-23 22:14:13 +01:00 committed by Jan Dittberner
parent e8ad6b9ba7
commit 774c6b0e9c
23 changed files with 597 additions and 41 deletions

View file

@ -39,6 +39,7 @@ services:
MYSQL_WEBDB_DATABASE: cacert
CSR_DIRECTORY: /certs/csr
CRT_DIRECTORY: /certs/crt
CRL_DIRECTORY: /certs/crl
DEFAULT_HOSTNAME: www.cacert.localhost
SECURE_HOSTNAME: secure.cacert.localhost
TVERIFY_HOSTNAME: tverify.cacert.localhost
@ -97,6 +98,7 @@ services:
MYSQL_WEBDB_DATABASE: cacert
CSR_DIRECTORY: /srv/certs/csr
CRT_DIRECTORY: /srv/certs/crt
CRL_DIRECTORY: /srv/certs/crl
volumes:
- certstaging:/srv/certs
- signersockets:/srv/sockets
@ -109,6 +111,7 @@ services:
environment:
SIGNER_WORKDIR: /srv/ca/work
SIGNER_CA_CONFIG: /srv/caconfig
SIGNER_BASEDIR: /srv/ca
volumes:
- signersockets:/srv/sockets
- signerdata:/srv/ca

View file

@ -8,6 +8,10 @@ cp /usr/local/etc/application/feed.rss /www/pages/index/feed.rss
make -C /www/locale
mkdir -p "$CSR_DIRECTORY" "$CRT_DIRECTORY"
chown www-data "$CSR_DIRECTORY" "$CRT_DIRECTORY"
chmod 0755 "$CSR_DIRECTORY" "$CRT_DIRECTORY"
apache2ctl start "$@"
exec tail -F --follow=name --retry /var/log/apache2/error.log /var/log/apache2/phperror.log

View file

@ -8,6 +8,20 @@ sleep 1
export SERIAL_PORT=/dev/ttyUSB0
mkdir -p /srv/ca/CA/certs /srv/ca/CA/private /srv/ca/CA/newcerts
cp /srv/testca/root/ca.crt.pem /srv/ca/CA/ca.crt.pem
cp /srv/testca/root/private/ca.key.pem /srv/ca/CA/private/ca.key.pem
if [ ! -f /srv/ca/CA/index.txt ]; then cp /srv/testca/root/index.txt /srv/ca/CA/index.txt; fi
if [ ! -f /srv/ca/CA/serial ]; then echo 1 > /srv/ca/CA/serial; fi
if [ ! -f /srv/ca/CA/crlnumber ]; then echo 1000 > /srv/ca/CA/crlnumber; fi
mkdir -p /srv/ca/class3/certs /srv/ca/class3/private /srv/ca/class3/newcerts
cp /srv/testca/class3/ca.crt.pem /srv/ca/class3/ca.crt.pem
cp /srv/testca/class3/private/ca.key.pem /srv/ca/class3/private/ca.key.pem
if [ ! -f /srv/ca/class3/index.txt ]; then cp /srv/testca/class3/index.txt /srv/ca/class3/index.txt; fi
if [ ! -f /srv/ca/class3/serial ]; then echo 1 > /srv/ca/class3/serial; fi
if [ ! -f /srv/ca/class3/crlnumber ]; then echo 1000 > /srv/ca/class3/crlnumber; fi
cd /srv/CommModule/
touch server.pl-active

View file

@ -0,0 +1,40 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/class3 # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 200 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = optional
emailAddress = optional
[ usr_cert ]
basicConstraints = critical, CA:FALSE
nsComment = "To get your own certificate for FREE head over to http://www.CAcert.org"
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
extendedKeyUsage = emailProtection, clientAuth, codeSigning, msCodeInd, msCodeCom, msEFS, msSGC, nsSGC
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org
crlDistributionPoints = URI:http://crl.cacert.localhost/test-class3-revoke.crl
subjectAltName = email:copy
[ crl_ext ]

View file

@ -0,0 +1,40 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/class3 # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 200 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = optional
emailAddress = optional
[ usr_cert ]
basicConstraints = critical, CA:FALSE
nsComment = "To get your own certificate for FREE head over to http://www.CAcert.org"
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
extendedKeyUsage = emailProtection, clientAuth, msEFS, msSGC, nsSGC
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
subjectAltName = email:copy
[ crl_ext ]

View file

@ -5,13 +5,13 @@ default_ca = CA_default # The default ca section
dir = /srv/ca/class3 # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
crlnumber = $dir/crlnumber # bug-1438
crlnumber = $dir/crlnumber # Where the current CRL-number is stored (bug-1438)
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/ca.key.pem # The private key
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 200 # how long to certify for
@ -37,3 +37,5 @@ extendedKeyUsage = emailProtection, clientAuth, msEFS, msSGC, nsSGC
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
subjectAltName = email:copy
[ crl_ext ]

View file

@ -0,0 +1,38 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/class3 # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 200 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = optional
emailAddress = optional
[ usr_cert ]
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
extendedKeyUsage = serverAuth,OCSPSigning,nsSGC,msSGC
# no authorityInfoAccess to avoid loops
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
[ crl_ext ]

View file

@ -0,0 +1,39 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/class3 # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 180 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = optional
subjectAltName = optional
emailAddress = optional
[ usr_cert ]
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
extendedKeyUsage = clientAuth,serverAuth,nsSGC,msSGC
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
[ crl_ext ]

View file

@ -0,0 +1,34 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/class3 # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
crlnumber = $dir/crlnumber # Where the current CRL-number is stored (bug-1438)
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 180 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
commonName = optional
subjectAltName = optional
[ usr_cert ]
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
extendedKeyUsage = clientAuth,serverAuth,nsSGC,msSGC
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
[ crl_ext ]

View file

@ -0,0 +1,33 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/class3 # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 180 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
commonName = optional
subjectAltName = optional
[ usr_cert ]
basicConstraints = critical,CA:TRUE
extendedKeyUsage = clientAuth,serverAuth,nsSGC,msSGC
keyUsage = digitalSignature,keyEncipherment
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
[ crl_ext ]

View file

@ -0,0 +1,38 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/class3 # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 200 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = optional
emailAddress = optional
[ usr_cert ]
basicConstraints = critical,CA:FALSE
extendedKeyUsage = clientAuth,serverAuth,timeStamping
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl
subjectAltName = email:copy
[ crl_ext ]

View file

@ -0,0 +1,40 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 200 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = optional
emailAddress = optional
[ usr_cert ]
basicConstraints = critical,CA:FALSE
nsComment = "To get your own certificate for FREE head over to http://www.CAcert.org"
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
extendedKeyUsage = emailProtection,clientAuth,codeSigning,msCodeInd,msCodeCom,msEFS,msSGC,nsSGC
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
subjectAltName = email:copy
[ crl_ext ]

View file

@ -0,0 +1,40 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 200 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = optional
emailAddress = optional
[ usr_cert ]
basicConstraints = critical,CA:FALSE
nsComment = "To get your own certificate for FREE head over to http://www.CAcert.org"
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
extendedKeyUsage = emailProtection,clientAuth,msEFS,msSGC,nsSGC
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
subjectAltName = email:copy
[ crl_ext ]

View file

@ -11,7 +11,7 @@ new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/ca.key.pem # The private key
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 200 # how long to certify for
@ -34,6 +34,8 @@ basicConstraints = critical, CA:FALSE
nsComment = "To get your own certificate for FREE head over to http://www.CAcert.org"
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
extendedKeyUsage = emailProtection,clientAuth,msEFS,msSGC,nsSGC
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
subjectAltName = email:copy
[ crl_ext ]

View file

@ -0,0 +1,38 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 200 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = optional
emailAddress = optional
[ usr_cert ]
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
extendedKeyUsage = serverAuth,OCSPSigning,nsSGC,msSGC
# no authorityInfoAccess to avoid loops
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
[ crl_ext ]

View file

@ -0,0 +1,39 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 200 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = optional
subjectAltName = optional
emailAddress = optional
[ usr_cert ]
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
extendedKeyUsage = clientAuth,serverAuth,nsSGC,msSGC
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
[ crl_ext ]

View file

@ -0,0 +1,34 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
crlnumber = $dir/crlnumber # Where the current CRL-number is stored (bug-1438)
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 200 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
commonName = optional
subjectAltName = optional
[ usr_cert ]
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement
extendedKeyUsage = clientAuth,serverAuth,nsSGC,msSGC
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
[ crl_ext ]

View file

@ -0,0 +1,34 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
crlnumber = $dir/crlnumber # Where the current CRL-number is stored (bug-1438)
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 200 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
commonName = optional
subjectAltName = optional
[ usr_cert ]
basicConstraints = critical,CA:TRUE
extendedKeyUsage = clientAuth,serverAuth,nsSGC,msSGC
keyUsage = digitalSignature,keyEncipherment
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
crlDistributionPoints = URI:http://crl.cacert.localhost/revoke.crl
[ crl_ext ]

View file

@ -0,0 +1,38 @@
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /srv/ca/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
crlnumber = $dir/crlnumber # Where the current CRL-number is stored (bug-1438)
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/ca.crt.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 200 # how long to certify for
default_crl_days = 30 # how long before next CRL
default_md = sha512 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = optional
emailAddress = optional
[ usr_cert ]
basicConstraints = critical,CA:FALSE
extendedKeyUsage = clientAuth,serverAuth,timeStamping
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.localhost
subjectAltName = email:copy
[ crl_ext ]

View file

@ -29,7 +29,7 @@ COPY testca/class3/ca.crt.pem /etc/apache2/ssl/certs/clientca.crt
COPY docker/apache-mgr-virtualhost.conf /etc/apache2/sites-available/mgr.cacert.localhost.conf
COPY docker/mgr-application.ini /usr/local/etc/
VOLUME /var/www
VOLUME /var/www/mgr
RUN a2ensite mgr.cacert.localhost ; \
a2dissite 000-default ; \

View file

@ -10,15 +10,18 @@ RUN apt-get update \
openssl \
perl \
socat \
xdelta \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*
VOLUME /srv/ca
COPY cacert-software/CommModule/server.pl \
cacert-software/CommModule/logclean.sh \
/srv/CommModule/
COPY docker/run-signer usr/local/bin/
COPY docker/signer-config/* /srv/caconfig/
COPY testca /srv/testca/
VOLUME /srv/ca
CMD ["/usr/local/bin/run-signer"]

View file

@ -11,6 +11,7 @@ RUN apt-get update \
openssl \
perl \
socat \
xdelta \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*

View file

@ -12,6 +12,8 @@ RUN apt-get update \
make \
netbase \
nullmailer \
openssl-blacklist \
openssl-blacklist-extra \
php-apc \
php-fpdf \
php-gettext \