alf-genssl/openssl.cnf at main · ecm4u/alf-genssl · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
[ ca ]
default_ca      = local_ca

# Default location of directories and files needed to generate certificates.
#
[ local_ca ]
dir             = /opt/alfresco/etc/ssl/applianceCA
certificate     = $dir/certs/rootCA.crt
database        = $dir/index.txt
new_certs_dir   = $dir/signedcerts
private_key     = $dir/private/rootCA.key
serial          = $dir/serial
#
# For certificate revocation lists.
crlnumber         = $dir/crlnumber
crl               = $dir/crl/ca.crl.pem
crl_extensions    = crl_ext
default_crl_days  = 30
#

# Default expiration and encryption policies for certificates.
#
default_crl_days        = 365
default_days            = 3650
default_md              = sha256
#
policy          = local_ca_policy

#
# Copy extensions specified in the certificate request
#
copy_extensions = copy
#
#
# Default policy to use when generating server certificates.  The following
# fields must be defined in the server certificate.
#
[ local_ca_policy ]
commonName              = supplied
stateOrProvinceName     = supplied
countryName             = supplied
organizationName        = supplied
organizationalUnitName  = supplied
emailAddress            = optional

[ req ]
# Options for the `req` tool (`man req`).
default_bits        = 2048
distinguished_name  = req_distinguished_name
string_mask         = utf8only
default_md      = sha256
#
prompt                  = no

#
#
# Root Certificate Authority distinguished name.  Change these fields to match
# your local environment!
#
[ req_distinguished_name ]
commonName              = Alfresco Appliance Root Certificate Authority
stateOrProvinceName     = NA
countryName             = DE
emailAddress            = ca-appliance@ecm4u.de
0.organizationName        = ecm4u GmbH
organizationalUnitName  = Support Team
localityName                    = Locality Name

[ v3_ca ]
# Extensions for a typical CA (`man x509v3_config`).
# subjectKeyIdentifier = hash
# authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical,CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ server_cert ]
# Extensions for server certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names

[ client_cert ]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth

[ crl_ext ]
# Extension for CRLs (`man x509v3_config`).
authorityKeyIdentifier=keyid:always

[alt_names]
DNS.1 = localhost