I attached to examples from a testinstallation of 0.9.2 (CVS HEAD). openssl.cnf is the OpenSSL configuration for the CA cert and User.ext is the usual extensionfile for the role User. Both files include an example how to configure multiple CDPs (please ignore the equality of the used URLs :) ).
Michael -- ------------------------------------------------------------------- Michael Bell Email: [EMAIL PROTECTED] ZE Computer- und Medienservice Tel.: +49 (0)30-2093 2482 (Computing Centre) Fax: +49 (0)30-2093 2704 Humboldt-University of Berlin Unter den Linden 6 10099 Berlin Email (private): [EMAIL PROTECTED] Germany http://www.openca.org
# # OpenSSL example configuration file. # This is mostly being used for generation of certificate requests. #
# This definition stops the following lines choking if HOME isn't
# defined.
HOME = .
RANDFILE = /home/michael/OpenCA/Test/test1/OpenCA/var/crypto/keys/.rand
# Extra OBJECT IDENTIFIER info:
#oid_file = $ENV::HOME/.oid
oid_section = new_oids
# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)
[ new_oids ]
# We can add new OIDs in here for use by 'ca' and 'req'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6
## used by ISIS-MTT
pseudonym=2.5.4.65
####################################################################
[ ca ]
default_ca = CA_default # The default ca section
####################################################################
[ CA_default ]
dir = /home/michael/OpenCA/Test/test1/OpenCA/var/crypto # Where
everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crls # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/certs # default place for new certs.
certificate = $dir/cacerts/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crls/current.pem # The current CRL
private_key = $dir/keys/cakey.pem # The private key
RANDFILE = $dir/keys/.rand # private random number file
oid_file = $dir/.oid
x509_extensions = user_cert # The extentions to add to the cert
email_in_dn = no # Don't add EMAIL field in DN
#crl_extensions = crl_ext # Extensions to add to CRL
# As Netscape only accepts CLRs V1,
# DON't use CRL's extensions
# at least if you are uning Netscape
# 4.5(-).
default_days = 365 # how long to certify for
default_crl_days= 31 # how long before next CRL
default_md = sha1 # which md to use.
preserve = yes # keep passed DN ordering
# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy = policy_match
# For the CA policy
[ policy_match ]
countryName = supplied
organizationName = supplied
organizationalUnitName = optional
commonName = optional
emailAddress = optional
# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName = supplied
## stateOrProvinceName = optional
## localityName = optional
organizationName = supplied
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
####################################################################
[ req ]
default_bits = 1024
default_keyfile = privkey.pem
default_md = sha1
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = v3_ca # The extentions to
# add to the self signed
# cert
[ req_distinguished_name ]
emailAddress = Email Address
emailAddress_max = 60
commonName = Common Name (eg, YOUR name)
commonName_max = 64
organizationalUnitName = Organizational Unit Name (eg, section)
#organizationalUnitName_default = Humboldt-Universitaet zu Berlin User
0.organizationName = Organization Name (eg, company)
0.organizationName_default = Humboldt-Universitaet zu Berlin
countryName = Country Name (2 letter code)
countryName_default = DE
countryName_min = 2
countryName_max = 2
## stateOrProvinceName = State or Province Name (full name)
## stateOrProvinceName_default = Some-State
## localityName = Locality Name (eg, city)
# we can do this but it is not needed normally :-)
#1.organizationName = Second Organization Name (eg, company)
#1.organizationName_default = World Wide Web Pty Ltd
SET-ex3 = SET extension number 3
[ req_attributes ]
## challengePassword = A challenge password
## challengePassword_min = 4
## challengePassword_max = 20
## unstructuredName = An optional company name
#################################################################
[ v3_ca]
# Extensions for a typical CA
# It's a CA certificate
basicConstraints = critical, CA:true
# PKIX recommendation.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
keyUsage = digitalSignature, nonRepudiation, cRLSign, keyCertSign
subjectAltName=email:copy
issuerAltName=issuer:copy
# Netscape
nsCertType = sslCA, emailCA, objCA
nsComment = "Humboldt-Universitaet zu Berlin Certification Authority
Certificate"
# CRLs
crlDistributionPoints = @cdp_section
nsCaRevocationUrl = http://ra.hu-berlin.de/pub/crl/cacrl.crl
nsRevocationUrl = http://ra.hu-berlin.de/pub/crl/cacrl.crl
# Additional
# authorityInfoAccess=OCSP;URI:http://[EMAIL PROTECTED]@/ocsp
# authorityInfoAccess=caIssuers;URI:http://[EMAIL PROTECTED]@/ca/ca.html
# RAW DER hex encoding of an extension: beware experts only!
# 1.2.3.5=RAW:02:03
# You can even override a supported extension:
# basicConstraints= critical, RAW:30:03:01:01:FF
#################################################################
[ crl_ext ]
# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
# As Netscape only accepts CLRs Version1, DON't use CRL's extensions
# at least if you are uning Netscape 4.5(-).
# issuerAltName=issuer:copy
# authorityKeyIdentifier=keyid:always,issuer:always
[ cdp_section ]
URI.1=http://ra.hu-berlin.de/pub/crl/cacrl.crl
URI.2=http://ra.hu-berlin.de/pub/crl/cacrl.crl
# These extensions are added when 'ca' signs a request.
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE
# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.
# For an object signing certificate this would be used.
#nsCertType = objsign
# For normal client use this is typical
nsCertType = client, email
# This is typical also
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
## 1.3.6.1.4.1.311.20.2.2 Microsoft smartcardlogin
## send to [EMAIL PROTECTED] 2002-Aug-15
extendedKeyUsage = clientAuth, emailProtection, 1.3.6.1.4.1.311.20.2.2
nsComment = "User Certificate of Humboldt-Universitaet zu Berlin"
# PKIX recommendations
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
# Import the email address.
subjectAltName=${ENV::subjectAltName}
# Copy subject details
issuerAltName=issuer:copy
nsCaRevocationUrl = http://ra.hu-berlin.de/pub/crl/cacrl.crl
nsRevocationUrl = http://ra.hu-berlin.de/pub/crl/cacrl.crl
crlDistributionPoints = @cdp_section
[ cdp_section ]
URI.1=http://ra.hu-berlin.de/pub/crl/cacrl.crl
URI.2=http://ra.hu-berlin.de/pub/crl/cacrl.crl
