https://www.smithnet.org.uk/wiki/index.php?action=history&feed=atom&title=Openssl.conf 2026-04-10T21:13:32Z Revision history for this page on the wiki MediaWiki 1.43.1 https://www.smithnet.org.uk/wiki/index.php?title=Openssl.conf&diff=457&oldid=prev 2024-05-08T04:53:40Z

<p>2 revisions imported</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <tr class="diff-title" lang="en-GB"> <td colspan="1" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="1" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 04:53, 8 May 2024</td> </tr><tr><td colspan="2" class="diff-notice" lang="en-GB"><div class="mw-diff-empty">(No difference)</div> </td></tr></table>

NickPGSmith https://www.smithnet.org.uk/wiki/index.php?title=Openssl.conf&diff=456&oldid=prev 2023-02-17T21:02:12Z

<p>1 revision imported</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <tr class="diff-title" lang="en-GB"> <td colspan="1" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="1" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 21:02, 17 February 2023</td> </tr><tr><td colspan="2" class="diff-notice" lang="en-GB"><div class="mw-diff-empty">(No difference)</div> </td></tr></table>

NickPGSmith https://www.smithnet.org.uk/wiki/index.php?title=Openssl.conf&diff=455&oldid=prev 2021-06-29T11:45:26Z

<p>Created page with &quot;&lt;pre&gt; [ ca ] # `man ca` default_ca = CA_default [ CA_default ] dir = /home/user/CA/root certs = $dir/certs crl_dir = $dir/crl new_certs_di...&quot;</p> <p><b>New page</b></p><div>&lt;pre&gt;<br /> [ ca ]<br /> # `man ca`<br /> default_ca = CA_default<br /> <br /> [ CA_default ]<br /> dir = /home/user/CA/root<br /> certs = $dir/certs<br /> crl_dir = $dir/crl<br /> new_certs_dir = $dir/newcerts<br /> database = $dir/index.txt<br /> serial = $dir/serial<br /> RANDFILE = $dir/private/.rand<br /> <br /> # The root key and root certificate.<br /> private_key = $dir/private/ca.key.pem<br /> certificate = $dir/certs/ca.cert.pem<br /> <br /> # For certificate revocation lists.<br /> crlnumber = $dir/crlnumber<br /> crl = $dir/crl/ca.crl.pem<br /> crl_extensions = crl_ext<br /> default_crl_days = 30<br /> <br /> # SHA-1 is deprecated, so use SHA-2 instead.<br /> default_md = sha256<br /> <br /> name_opt = ca_default<br /> cert_opt = ca_default<br /> default_days = 720<br /> preserve = no<br /> policy = policy_strict<br /> #copy_extensions = copy<br /> <br /> [ policy_strict ]<br /> # The root CA should only sign intermediate certificates that match.<br /> # See the POLICY FORMAT section of `man ca`.<br /> countryName = match<br /> stateOrProvinceName = match<br /> organizationName = match<br /> organizationalUnitName = optional<br /> commonName = supplied<br /> emailAddress = optional<br /> <br /> [ policy_loose ]<br /> # Allow the intermediate CA to sign a more diverse range of certificates.<br /> # See the POLICY FORMAT section of the `ca` man page.<br /> countryName = optional<br /> stateOrProvinceName = optional<br /> localityName = optional<br /> organizationName = optional<br /> organizationalUnitName = optional<br /> commonName = supplied<br /> emailAddress = optional<br /> <br /> [ req ]<br /> # Options for the `req` tool (`man req`).<br /> default_bits = 4096<br /> distinguished_name = req_distinguished_name<br /> string_mask = utf8only<br /> <br /> # SHA-1 is deprecated, so use SHA-2 instead.<br /> default_md = sha256<br /> <br /> # Extension to add when the -x509 option is used.<br /> x509_extensions = v3_ca<br /> <br /> [ req_distinguished_name ]<br /> # See &lt;https://en.wikipedia.org/wiki/Certificate_signing_request&gt;.<br /> countryName = Country Name (2 letter code)<br /> stateOrProvinceName = State or Province Name<br /> localityName = Locality Name<br /> 0.organizationName = Organization Name<br /> organizationalUnitName = Organizational Unit Name<br /> commonName = Common Name<br /> emailAddress = Email Address<br /> <br /> # Optionally, specify some defaults.<br /> countryName_default = GB<br /> stateOrProvinceName_default = England<br /> localityName_default = London<br /> 0.organizationName_default = Example Ltd<br /> organizationalUnitName_default = Example Certificate Authority<br /> emailAddress_default = user@example.com<br /> <br /> [ v3_ca ]<br /> # Extensions for a typical CA (`man x509v3_config`).<br /> subjectKeyIdentifier = hash<br /> authorityKeyIdentifier = keyid:always,issuer<br /> basicConstraints = critical, CA:true<br /> keyUsage = critical, digitalSignature, cRLSign, keyCertSign<br /> <br /> [ v3_intermediate_ca ]<br /> # Extensions for a typical intermediate CA (`man x509v3_config`).<br /> subjectKeyIdentifier = hash<br /> authorityKeyIdentifier = keyid:always,issuer<br /> basicConstraints = critical, CA:true, pathlen:0<br /> keyUsage = critical, digitalSignature, cRLSign, keyCertSign<br /> <br /> [ usr_cert ]<br /> # Extensions for client certificates (`man x509v3_config`).<br /> basicConstraints = CA:FALSE<br /> nsCertType = client, email<br /> nsComment = &quot;OpenSSL Generated Client Certificate&quot;<br /> subjectKeyIdentifier = hash<br /> authorityKeyIdentifier = keyid,issuer<br /> keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment<br /> extendedKeyUsage = clientAuth, emailProtection<br /> <br /> [ server_cert ]<br /> # Extensions for server certificates (`man x509v3_config`).<br /> basicConstraints = CA:FALSE<br /> nsCertType = server<br /> nsComment = &quot;OpenSSL Generated Server Certificate&quot;<br /> subjectKeyIdentifier = hash<br /> authorityKeyIdentifier = keyid,issuer:always<br /> keyUsage = critical, digitalSignature, keyEncipherment<br /> extendedKeyUsage = serverAuth<br /> <br /> [ crl_ext ]<br /> # Extension for CRLs (`man x509v3_config`).<br /> authorityKeyIdentifier=keyid:always<br /> <br /> [ ocsp ]<br /> # Extension for OCSP signing certificates (`man ocsp`).<br /> basicConstraints = CA:FALSE<br /> subjectKeyIdentifier = hash<br /> authorityKeyIdentifier = keyid,issuer<br /> keyUsage = critical, digitalSignature<br /> extendedKeyUsage = critical, OCSPSigning<br /> &lt;/pre&gt;</div>

NickPGSmith