Subversion Repositories sysadmin_scripts

Rev

Rev 180 | Rev 185 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log | RSS feed

Rev 180 Rev 182
Line 1... Line 1...
1 
[ req ]
 1 
[ req ]
2 
default_bits       = 2048 # default key size
 2 
default_bits        = 2048            # Size of keys
3 
default_md         = sha256 # default message digest algorithm
 3 
default_keyfile     = privkey.pem     # Default private key file
4 
distinguished_name = req_distinguished_name # definition used for DN
 4 
distinguished_name  = req_distinguished_name
5 
req_extensions     = v3_req # go look at v3_req section for the extensions def
 5 
prompt              = no
- 
 
 6 
#string_mask         = utf8
6 
prompt             = no # do not ask questions, take defaults
 7 
req_extensions      = req_ext          # Extensions to add to certificate requests
7 
 
 8 
 
8 
[ req_distinguished_name ]
 9 
[ req_distinguished_name ]
9 
#commonName              = required # may also use CN
 - 
 
10 
#countryName             = optional # may also use C
 - 
 
11 
#stateOrProvinceName     = optional # may also use ST
 - 
 
12 
#organizationName        = optional # may also use O
 - 
 
13 
#organizationalUnitName  = optional # may also use OU
 - 
 
14 
#emailAddress            = optional
10 
# Modify these for your network
15 
 
 - 
 
16 
# Required fields
 - 
 
17 
CN = www.example.com
 - 
 
18 
# not required
 - 
 
19 
C  = US
 11 
C  = US
20 
ST = Texas
 12 
ST = Texas
21 
O  = Example Corp
 - 
 
22 
L  = Dallas
 13 
L  = Dallas
23 
OU = Headquarters
 14 
O  = Example Corp
- 
 
 15 
OU = Office
- 
 
 16 
CN = example.org
24 
emailAddress = info@example.com
 17 
emailAddress = admin@example.org
- 
 
 18 
 
- 
 
 19 
[ req_ext ]
- 
 
 20 
keyUsage = critical, digitalSignature, keyEncipherment
- 
 
 21 
extendedKeyUsage = serverAuth
- 
 
 22 
subjectAltName = @alt_names
- 
 
 23 
 
- 
 
 24 
# this section gets destroyed when creating server ext files
- 
 
 25 
[alt_names]
- 
 
 26 
DNS.1 = mydomain.com
- 
 
 27 
DNS.2 = www.mydomain.com
- 
 
 28 
 
- 
 
 29 
# used when creating a CA
- 
 
 30 
[ ca ]
- 
 
 31 
default_ca = CA_default
- 
 
 32 
 
- 
 
 33 
[ CA_default ]
- 
 
 34 
keyUsage = critical, digitalSignature, keyEncipherment
- 
 
 35 
basicConstraints = CA:TRUE
- 
 
 36 
 
- 
 
 37 
# used when creating a Server Cert
- 
 
 38 
[ server ]
- 
 
 39 
# Extensions for server certificates
- 
 
 40 
keyUsage = critical, digitalSignature, keyEncipherment
- 
 
 41 
extendedKeyUsage = serverAuth
- 
 
 42 
basicConstraints = CA:FALSE  # Specify that this is not a CA
25 
 
 43 
 
26 
[ v3_req ]
 - 
 
27 
keyUsage          = critical, digitalSignature, keyEncipherment
 - 
 
28 
extendedKeyUsage  = serverAuth, clientAuth
 - 
 
29 
subjectAltName    = @alt_names # look for section [ alt_names ] for all the names
 - 
 
30 
basicConstraints  = CA:FALSE
 - 
 
31 
# these are not used in our scenario
 - 
 
32 
# authorityKeyIdentifier = keyid,issuer
 - 
 
33 
#certificatePolicies = policies that govern the use of the certificate, useful in compliance scenarios
 - 
 
34 
#crlDistributionPoints =  URLs for retrieving the CRL
 - 
 
35 
 
 - 
 
36 
# list of all names for the cert, filled in by makeCert if .ext file does
 - 
 
37 
# not exist
 - 
 
38 
[ alt_names ]
 - 
 
39 
 
 44