1*b7c941bbSAndroid Build Coastguard Worker# OpenSSL root CA configuration file. 2*b7c941bbSAndroid Build Coastguard Worker# Copy to `/root/ca/openssl.cnf`. 3*b7c941bbSAndroid Build Coastguard Worker 4*b7c941bbSAndroid Build Coastguard Worker[ ca ] 5*b7c941bbSAndroid Build Coastguard Worker# `man ca` 6*b7c941bbSAndroid Build Coastguard Worker 7*b7c941bbSAndroid Build Coastguard Worker[ RootCA ] 8*b7c941bbSAndroid Build Coastguard Worker# Directory and file locations. 9*b7c941bbSAndroid Build Coastguard Workerdir = ./rootca 10*b7c941bbSAndroid Build Coastguard Workercerts = $dir/certs 11*b7c941bbSAndroid Build Coastguard Workercrl_dir = $dir/crl 12*b7c941bbSAndroid Build Coastguard Workernew_certs_dir = $dir/newcerts 13*b7c941bbSAndroid Build Coastguard Workerdatabase = $dir/index.txt 14*b7c941bbSAndroid Build Coastguard Workerserial = $dir/serial 15*b7c941bbSAndroid Build Coastguard WorkerRANDFILE = $dir/private/.rand 16*b7c941bbSAndroid Build Coastguard Worker 17*b7c941bbSAndroid Build Coastguard Worker# The root key and root certificate. 18*b7c941bbSAndroid Build Coastguard Workerprivate_key = $dir/private/ca.key.pem 19*b7c941bbSAndroid Build Coastguard Workercertificate = $dir/certs/ca.cert.pem 20*b7c941bbSAndroid Build Coastguard Worker 21*b7c941bbSAndroid Build Coastguard Worker# For certificate revocation lists. 22*b7c941bbSAndroid Build Coastguard Workercrlnumber = $dir/crlnumber 23*b7c941bbSAndroid Build Coastguard Workercrl = $dir/crl/ca.crl.pem 24*b7c941bbSAndroid Build Coastguard Workercrl_extensions = crl_ext 25*b7c941bbSAndroid Build Coastguard Workerdefault_crl_days = 30 26*b7c941bbSAndroid Build Coastguard Worker 27*b7c941bbSAndroid Build Coastguard Worker# SHA-1 is deprecated, so use SHA-2 instead. 28*b7c941bbSAndroid Build Coastguard Workerdefault_md = sha256 29*b7c941bbSAndroid Build Coastguard Worker 30*b7c941bbSAndroid Build Coastguard Workername_opt = ca_default 31*b7c941bbSAndroid Build Coastguard Workercert_opt = ca_default 32*b7c941bbSAndroid Build Coastguard Workerdefault_days = 375 33*b7c941bbSAndroid Build Coastguard Workerpreserve = no 34*b7c941bbSAndroid Build Coastguard Workerpolicy = policy_strict 35*b7c941bbSAndroid Build Coastguard Worker 36*b7c941bbSAndroid Build Coastguard Worker[ IntermediateCA ] 37*b7c941bbSAndroid Build Coastguard Worker# Directory and file locations. 38*b7c941bbSAndroid Build Coastguard Workerdir = ./intermediate 39*b7c941bbSAndroid Build Coastguard Workercerts = $dir/certs 40*b7c941bbSAndroid Build Coastguard Workercrl_dir = $dir/crl 41*b7c941bbSAndroid Build Coastguard Workernew_certs_dir = $dir/newcerts 42*b7c941bbSAndroid Build Coastguard Workerdatabase = $dir/index.txt 43*b7c941bbSAndroid Build Coastguard Workerserial = $dir/serial 44*b7c941bbSAndroid Build Coastguard WorkerRANDFILE = $dir/private/.rand 45*b7c941bbSAndroid Build Coastguard Worker 46*b7c941bbSAndroid Build Coastguard Worker# The root key and root certificate. 47*b7c941bbSAndroid Build Coastguard Workerprivate_key = $dir/private/intermediate.key.pem 48*b7c941bbSAndroid Build Coastguard Workercertificate = $dir/certs/intermediate.cert.pem 49*b7c941bbSAndroid Build Coastguard Worker 50*b7c941bbSAndroid Build Coastguard Worker# For certificate revocation lists. 51*b7c941bbSAndroid Build Coastguard Workercrlnumber = $dir/crlnumber 52*b7c941bbSAndroid Build Coastguard Workercrl = $dir/crl/ca.crl.pem 53*b7c941bbSAndroid Build Coastguard Workercrl_extensions = crl_ext 54*b7c941bbSAndroid Build Coastguard Workerdefault_crl_days = 30 55*b7c941bbSAndroid Build Coastguard Worker 56*b7c941bbSAndroid Build Coastguard Worker# SHA-1 is deprecated, so use SHA-2 instead. 57*b7c941bbSAndroid Build Coastguard Workerdefault_md = sha256 58*b7c941bbSAndroid Build Coastguard Worker 59*b7c941bbSAndroid Build Coastguard Workername_opt = ca_default 60*b7c941bbSAndroid Build Coastguard Workercert_opt = ca_default 61*b7c941bbSAndroid Build Coastguard Workerdefault_days = 375 62*b7c941bbSAndroid Build Coastguard Workerpreserve = no 63*b7c941bbSAndroid Build Coastguard Workerpolicy = policy_strict 64*b7c941bbSAndroid Build Coastguard Worker 65*b7c941bbSAndroid Build Coastguard Worker[ policy_strict ] 66*b7c941bbSAndroid Build Coastguard Worker# The root CA should only sign intermediate certificates that match. 67*b7c941bbSAndroid Build Coastguard Worker# See the POLICY FORMAT section of `man ca`. 68*b7c941bbSAndroid Build Coastguard WorkercountryName = match 69*b7c941bbSAndroid Build Coastguard WorkerstateOrProvinceName = match 70*b7c941bbSAndroid Build Coastguard WorkerorganizationName = match 71*b7c941bbSAndroid Build Coastguard WorkerorganizationalUnitName = optional 72*b7c941bbSAndroid Build Coastguard WorkercommonName = supplied 73*b7c941bbSAndroid Build Coastguard WorkeremailAddress = optional 74*b7c941bbSAndroid Build Coastguard Worker 75*b7c941bbSAndroid Build Coastguard Worker[ policy_loose ] 76*b7c941bbSAndroid Build Coastguard Worker# Allow the intermediate CA to sign a more diverse range of certificates. 77*b7c941bbSAndroid Build Coastguard Worker# See the POLICY FORMAT section of the `ca` man page. 78*b7c941bbSAndroid Build Coastguard WorkercountryName = optional 79*b7c941bbSAndroid Build Coastguard WorkerstateOrProvinceName = optional 80*b7c941bbSAndroid Build Coastguard WorkerlocalityName = optional 81*b7c941bbSAndroid Build Coastguard WorkerorganizationName = optional 82*b7c941bbSAndroid Build Coastguard WorkerorganizationalUnitName = optional 83*b7c941bbSAndroid Build Coastguard WorkercommonName = supplied 84*b7c941bbSAndroid Build Coastguard WorkeremailAddress = optional 85*b7c941bbSAndroid Build Coastguard Worker 86*b7c941bbSAndroid Build Coastguard Worker[ req ] 87*b7c941bbSAndroid Build Coastguard Worker# Options for the `req` tool (`man req`). 88*b7c941bbSAndroid Build Coastguard Workerdefault_bits = 4096 89*b7c941bbSAndroid Build Coastguard Workerdistinguished_name = req_distinguished_name 90*b7c941bbSAndroid Build Coastguard Workerstring_mask = utf8only 91*b7c941bbSAndroid Build Coastguard Worker 92*b7c941bbSAndroid Build Coastguard Worker# SHA-1 is deprecated, so use SHA-2 instead. 93*b7c941bbSAndroid Build Coastguard Workerdefault_md = sha256 94*b7c941bbSAndroid Build Coastguard Worker 95*b7c941bbSAndroid Build Coastguard Worker# Extension to add when the -x509 option is used. 96*b7c941bbSAndroid Build Coastguard Workerx509_extensions = v3_ca 97*b7c941bbSAndroid Build Coastguard Worker 98*b7c941bbSAndroid Build Coastguard Worker[ req_distinguished_name ] 99*b7c941bbSAndroid Build Coastguard Worker# See <https://en.wikipedia.org/wiki/Certificate_signing_request>. 100*b7c941bbSAndroid Build Coastguard WorkercountryName = Country Name (2 letter code) 101*b7c941bbSAndroid Build Coastguard WorkerstateOrProvinceName = State or Province Name 102*b7c941bbSAndroid Build Coastguard Worker0.organizationName = Organization Name 103*b7c941bbSAndroid Build Coastguard WorkerorganizationalUnitName = Organizational Unit Name 104*b7c941bbSAndroid Build Coastguard WorkercommonName = Common Name 105*b7c941bbSAndroid Build Coastguard Worker 106*b7c941bbSAndroid Build Coastguard Worker# Optionally, specify some defaults. 107*b7c941bbSAndroid Build Coastguard WorkercountryName_default = GB 108*b7c941bbSAndroid Build Coastguard WorkerstateOrProvinceName_default = England 109*b7c941bbSAndroid Build Coastguard Worker0.organizationName_default = Google UK 110*b7c941bbSAndroid Build Coastguard WorkerorganizationalUnitName_default = AfW 111*b7c941bbSAndroid Build Coastguard Worker 112*b7c941bbSAndroid Build Coastguard Worker[ v3_ca ] 113*b7c941bbSAndroid Build Coastguard Worker# Extensions for a typical CA (`man x509v3_config`). 114*b7c941bbSAndroid Build Coastguard WorkersubjectKeyIdentifier = hash 115*b7c941bbSAndroid Build Coastguard WorkerauthorityKeyIdentifier = keyid:always,issuer 116*b7c941bbSAndroid Build Coastguard WorkerbasicConstraints = critical, CA:true 117*b7c941bbSAndroid Build Coastguard WorkerkeyUsage = critical, digitalSignature, cRLSign, keyCertSign 118*b7c941bbSAndroid Build Coastguard Worker 119*b7c941bbSAndroid Build Coastguard Worker[ v3_intermediate_ca ] 120*b7c941bbSAndroid Build Coastguard Worker# Extensions for a typical intermediate CA (`man x509v3_config`). 121*b7c941bbSAndroid Build Coastguard WorkersubjectKeyIdentifier = hash 122*b7c941bbSAndroid Build Coastguard WorkerauthorityKeyIdentifier = keyid:always,issuer 123*b7c941bbSAndroid Build Coastguard WorkerbasicConstraints = critical, CA:true, pathlen:0 124*b7c941bbSAndroid Build Coastguard WorkerkeyUsage = critical, digitalSignature, cRLSign, keyCertSign 125*b7c941bbSAndroid Build Coastguard Worker 126*b7c941bbSAndroid Build Coastguard Worker[ usr_cert ] 127*b7c941bbSAndroid Build Coastguard Worker# Extensions for client certificates (`man x509v3_config`). 128*b7c941bbSAndroid Build Coastguard WorkerbasicConstraints = CA:FALSE 129*b7c941bbSAndroid Build Coastguard WorkernsCertType = client, email 130*b7c941bbSAndroid Build Coastguard WorkernsComment = "OpenSSL Generated Client Certificate" 131*b7c941bbSAndroid Build Coastguard WorkersubjectKeyIdentifier = hash 132*b7c941bbSAndroid Build Coastguard WorkerauthorityKeyIdentifier = keyid,issuer 133*b7c941bbSAndroid Build Coastguard WorkerkeyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment 134*b7c941bbSAndroid Build Coastguard WorkerextendedKeyUsage = clientAuth, emailProtection 135*b7c941bbSAndroid Build Coastguard Worker 136*b7c941bbSAndroid Build Coastguard Worker[ server_cert ] 137*b7c941bbSAndroid Build Coastguard Worker# Extensions for server certificates (`man x509v3_config`). 138*b7c941bbSAndroid Build Coastguard WorkerbasicConstraints = CA:FALSE 139*b7c941bbSAndroid Build Coastguard WorkernsCertType = server 140*b7c941bbSAndroid Build Coastguard WorkernsComment = "OpenSSL Generated Server Certificate" 141*b7c941bbSAndroid Build Coastguard WorkersubjectKeyIdentifier = hash 142*b7c941bbSAndroid Build Coastguard WorkerauthorityKeyIdentifier = keyid,issuer:always 143*b7c941bbSAndroid Build Coastguard WorkerkeyUsage = critical, digitalSignature, keyEncipherment 144*b7c941bbSAndroid Build Coastguard WorkerextendedKeyUsage = serverAuth 145*b7c941bbSAndroid Build Coastguard Worker 146*b7c941bbSAndroid Build Coastguard Worker[ crl_ext ] 147*b7c941bbSAndroid Build Coastguard Worker# Extension for CRLs (`man x509v3_config`). 148*b7c941bbSAndroid Build Coastguard WorkerauthorityKeyIdentifier=keyid:always 149*b7c941bbSAndroid Build Coastguard Worker 150*b7c941bbSAndroid Build Coastguard Worker[ ocsp ] 151*b7c941bbSAndroid Build Coastguard Worker# Extension for OCSP signing certificates (`man ocsp`). 152*b7c941bbSAndroid Build Coastguard WorkerbasicConstraints = CA:FALSE 153*b7c941bbSAndroid Build Coastguard WorkersubjectKeyIdentifier = hash 154*b7c941bbSAndroid Build Coastguard WorkerauthorityKeyIdentifier = keyid,issuer 155*b7c941bbSAndroid Build Coastguard WorkerkeyUsage = critical, digitalSignature 156*b7c941bbSAndroid Build Coastguard WorkerextendedKeyUsage = critical, OCSPSigning 157