# X.509 Certificate options # # DN options # The organization of the subject. organization = "GNU" # The organizational unit of the subject. unit = "Wget" # The locality of the subject. # locality = # The state of the certificate owner. # state = "" # The country of the subject. Two letter code. # country = GR # The common name of the certificate owner. cn = "127.0.0.1" # A user id of the certificate owner. #uid = "" # Set domain components #dc = "name" #dc = "domain" # If the supported DN OIDs are not adequate you can set # any OID here. # For example set the X.520 Title and the X.520 Pseudonym # by using OID and string pairs. #dn_oid = 2.5.4.12 Dr. #dn_oid = 2.5.4.65 jackal # This is deprecated and should not be used in new # certificates. # pkcs9_email = "bug-wget@gnu.org" # An alternative way to set the certificate's distinguished name directly # is with the "dn" option. The attribute names allowed are: # C (country), street, O (organization), OU (unit), title, CN (common name), # L (locality), ST (state), placeOfBirth, gender, countryOfCitizenship, # countryOfResidence, serialNumber, telephoneNumber, surName, initials, # generationQualifier, givenName, pseudonym, dnQualifier, postalCode, name, # businessCategory, DC, UID, jurisdictionOfIncorporationLocalityName, # jurisdictionOfIncorporationStateOrProvinceName, # jurisdictionOfIncorporationCountryName, XmppAddr, and numeric OIDs. #dn = "cn = Nikos,st = New Something,C=GR,surName=Mavrogiannopoulos,2.5.4.9=Arkadias" # The serial number of the certificate # Comment the field for a time-based serial number. # serial = 007 # In how many days, counting from today, this certificate will expire. # Use -1 if there is no expiration date. expiration_days = -1 # Alternatively you may set concrete dates and time. The GNU date string # formats are accepted. See: # http://www.gnu.org/software/tar/manual/html_node/Date-input-formats.html #activation_date = "2004-02-29 16:21:42" #expiration_date = "2025-02-29 16:24:41" # X.509 v3 extensions # A dnsname in case of a WWW server. dns_name = "localhost" # A subject alternative name URI #uri = "http://www.example.com" # An IP address in case of a server. # ip_address = "127.0.0.1" # An email in case of a person # email = "none@none.org" # Challenge password used in certificate requests challenge_password = 123456 # Password when encrypting a private key #password = secret # An URL that has CRLs (certificate revocation lists) # available. Needed in CA certificates. #crl_dist_points = "http://www.getcrl.crl/getcrl/" # Whether this is a CA certificate or not # ca # Subject Unique ID (in hex) #subject_unique_id = 00153224 # Issuer Unique ID (in hex) #issuer_unique_id = 00153225 #### Key usage # The following key usage flags are used by CAs and end certificates # Whether this certificate will be used to sign data (needed # in TLS DHE ciphersuites). This is the digitalSignature flag # in RFC5280 terminology. signing_key # Whether this certificate will be used to encrypt data (needed # in TLS RSA ciphersuites). Note that it is preferred to use different # keys for encryption and signing. This is the keyEncipherment flag # in RFC5280 terminology. encryption_key # Whether this key will be used to sign other certificates. The # keyCertSign flag in RFC5280 terminology. # cert_signing_key # Whether this key will be used to sign CRLs. The # cRLSign flag in RFC5280 terminology. # crl_signing_key # The keyAgreement flag of RFC5280. It's purpose is loosely # defined. Not use it unless required by a protocol. #key_agreement # The dataEncipherment flag of RFC5280. It's purpose is loosely # defined. Not use it unless required by a protocol. #data_encipherment # The nonRepudiation flag of RFC5280. It's purpose is loosely # defined. Not use it unless required by a protocol. #non_repudiation #### Extended key usage (key purposes) # The following extensions are used in an end certificate # to clarify its purpose. Some CAs also use it to indicate # the types of certificates they are purposed to sign. # Whether this certificate will be used for a TLS client; # this sets the id-kp-serverAuth (1.3.6.1.5.5.7.3.1) of # extended key usage. #tls_www_client # Whether this certificate will be used for a TLS server; # This sets the id-kp-clientAuth (1.3.6.1.5.5.7.3.2) of # extended key usage. tls_www_server # Whether this key will be used to sign code. This sets the # id-kp-codeSigning (1.3.6.1.5.5.7.3.3) of extended key usage # extension. #code_signing_key # Whether this key will be used to sign OCSP data. This sets the # id-kp-OCSPSigning (1.3.6.1.5.5.7.3.9) of extended key usage extension. #ocsp_signing_key # Whether this key will be used for time stamping. This sets the # id-kp-timeStamping (1.3.6.1.5.5.7.3.8) of extended key usage extension. #time_stamping_key # Whether this key will be used for email protection. This sets the # id-kp-emailProtection (1.3.6.1.5.5.7.3.4) of extended key usage extension. #email_protection_key # Whether this key will be used for IPsec IKE operations (1.3.6.1.5.5.7.3.17). #ipsec_ike_key ## adding custom key purpose OIDs # for microsoft smart card logon # key_purpose_oid = 1.3.6.1.4.1.311.20.2.2 # for email protection # key_purpose_oid = 1.3.6.1.5.5.7.3.4 # for any purpose (must not be used in intermediate CA certificates) # key_purpose_oid = 2.5.29.37.0 ### end of key purpose OIDs # When generating a certificate from a certificate # request, then honor the extensions stored in the request # and store them in the real certificate. honor_crq_extensions # Path length constraint. Sets the maximum number of # certificates that can be used to certify this certificate. # (i.e. the certificate chain length) #path_len = -1 #path_len = 2 # OCSP URI # ocsp_uri = http://my.ocsp.server/ocsp # CA issuers URI # ca_issuers_uri = http://my.ca.issuer # Certificate policies #policy1 = 1.3.6.1.4.1.5484.1.10.99.1.0 #policy1_txt = "This is a long policy to summarize" #policy1_url = http://www.example.com/a-policy-to-read #policy2 = 1.3.6.1.4.1.5484.1.10.99.1.1 #policy2_txt = "This is a short policy" #policy2_url = http://www.example.com/another-policy-to-read # Name constraints # DNS #nc_permit_dns = example.com #nc_exclude_dns = test.example.com # EMAIL #nc_permit_email = "nmav@ex.net" # Exclude subdomains of example.com #nc_exclude_email = .example.com # Exclude all e-mail addresses of example.com #nc_exclude_email = example.com # Options for proxy certificates #proxy_policy_language = 1.3.6.1.5.5.7.21.1 # Options for generating a CRL # The number of days the next CRL update will be due. # next CRL update will be in 43 days #crl_next_update = 43 # this is the 5th CRL by this CA # Comment the field for a time-based number. #crl_number = 5 # Specify the update dates more precisely. #crl_this_update_date = "2004-02-29 16:21:42" #crl_next_update_date = "2025-02-29 16:24:41" # The date that the certificates will be made seen as # being revoked. #crl_revocation_date = "2025-02-29 16:24:41"