|
| 1 | +# OpenSSL configuration file. |
| 2 | + |
| 3 | +[ req ] |
| 4 | +# Options for the `req` tool (`man req`). |
| 5 | +default_bits = 2048 |
| 6 | +distinguished_name = req_distinguished_name |
| 7 | +prompt = no |
| 8 | +# SHA-1 is deprecated, so use SHA-2 instead. |
| 9 | +default_md = sha256 |
| 10 | +# Extension to add when the -x509 option is used. |
| 11 | +x509_extensions = v3_ca |
| 12 | +# Try to force use of PrintableString throughout |
| 13 | +string_mask = pkix |
| 14 | + |
| 15 | +[ req_distinguished_name ] |
| 16 | +C=GB |
| 17 | +ST=London |
| 18 | +L=London |
| 19 | +O=Google |
| 20 | +OU=Eng |
| 21 | +CN=FakeCertificateAuthority |
| 22 | + |
| 23 | +[ v3_ca ] |
| 24 | +subjectKeyIdentifier = 01020304 |
| 25 | +authorityKeyIdentifier = keyid:always,issuer |
| 26 | +basicConstraints = critical, CA:true, pathlen:10 |
| 27 | +keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly |
| 28 | + |
| 29 | +[ v3_int_ca ] |
| 30 | +subjectKeyIdentifier = 05060708 |
| 31 | +authorityKeyIdentifier = keyid:always,issuer |
| 32 | +basicConstraints = critical, CA:true, pathlen:0 |
| 33 | +keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly |
| 34 | +extendedKeyUsage = serverAuth,clientAuth |
| 35 | + |
| 36 | +[ v3_int_ca_pair ] |
| 37 | +subjectKeyIdentifier = 0a0b0c0d |
| 38 | +authorityKeyIdentifier = keyid:always,issuer |
| 39 | +basicConstraints = critical, CA:true |
| 40 | +keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly |
| 41 | +extendedKeyUsage = serverAuth,clientAuth |
| 42 | + |
| 43 | +[ v3_ca1 ] |
| 44 | +subjectKeyIdentifier = 11121314 |
| 45 | +authorityKeyIdentifier = keyid:always,issuer |
| 46 | +basicConstraints = critical, CA:true, pathlen:10 |
| 47 | +keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly |
| 48 | + |
| 49 | +[ v3_user ] |
| 50 | +subjectKeyIdentifier = hash |
| 51 | +authorityKeyIdentifier = keyid:always,issuer |
| 52 | +keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, encipherOnly, decipherOnly |
0 commit comments