-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathca.cnf
174 lines (148 loc) · 6.5 KB
/
ca.cnf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
HOME = .
RANDFILE = $ENV::HOME/.rnd
CANAME = $ENV::CANAME
CATOP = $ENV::CATOP
CRLAIA = $ENV::CRLAIA
SAN = $ENV::SAN
oid_section = new_oids
[ new_oids ]
microsoft = 1.3.6.1.4.1.311
MS_ENROLLMENT_NAME_VALUE_PAIR = ${microsoft}.13.2.1
MS_ID_ENROLLMENT_CSP_PROVIDER = ${microsoft}.13.2.2
MS_OS_VERSION = ${microsoft}.13.2.3
MS_ENROLL_CERTTYPE_EXTENSION = ${microsoft}.20.2
# openssl 側で定義済み
# msSmartcardLogin = ${microsoft}.20.2.2
MS_CERTSRV_CA_VERSION = ${microsoft}.21.1
MS_REQUEST_CLIENT_INFO = ${microsoft}.21.20
MS_ENCRYPTED_KEY_HASH = ${microsoft}.21.21
MS_CERTSRV_CROSSCA_VERSION = ${microsoft}.21.22
yubico = 1.3.6.1.4.1.41482
YUBIKEY_DEVICE_ID = ${yubico}.2
YUBIKEY_5_2 = ${yubico}.1.7
# [FIDO U2F Authenticator Transports Extension](https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-u2f-authenticator-transports-extension-v1.2-ps-20170411.html#fido-u2f-certificate-extensions)
id_fido = 1.3.6.1.4.1.45724
# [FIDO Metadata Statements](https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-metadata-statement-v2.0-rd-20180702.html)
ID_FIDO_GEN_CE_AAGUID = ${id_fido}.1.1.4
ID_FIDO_U2F_CE_TRANSPORTS = ${id_fido}.2.1.1
[ ca ]
default_ca = ca_any #!The default ca section
[ ca_any ]
dir = $CATOP #!Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crlnumber = $dir/crlnumber # the current crl number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = ext_ca # The extentions to add to the cert
name_opt = ca_default # Subject Name options
cert_opt = ca_default # Certificate field options
default_days = 730 # how long to certify for
default_crl_days= 180 # how long before next CRL
default_md = sha256 #!use public key default MD
preserve = yes #!keep passed DN ordering
policy = policy_ca
email_in_dn = no
unique_subject = no
[ policy_ca ]
organizationName = match
commonName = supplied
[ policy_any ]
commonName = supplied
[ policy_choroi ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ req ]
default_bits = 2048
default_keyfile = key.pem
distinguished_name = req_dn_ca
attributes = req_ca
x509_extensions = ext_ca
string_mask = utf8only
[ req_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = CA:true
#copy_extensions = copy
[ req_dn_ca ]
organizationName = Organization Name (eg, company)
organizationName_default = ToyCA
commonName = Common Name (e.g. server FQDN or YOUR name)
commonName_max = 64
[ req_attributes ]
[ ext_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = CA:true
authorityInfoAccess = caIssuers;URI:http://$CRLAIA/$CANAME.cer,OCSP;URI:http://$CRLAIA/ocsp/$CANAME
crlDistributionPoints = URI:http://$CRLAIA/$CANAME.crl
[ ext_enterprise ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = digitalSignature, keyCertSign, cRLSign
MS_ENROLL_CERTTYPE_EXTENSION = ASN1:BMP:SubCA
MS_CERTSRV_CA_VERSION = ASN1:INTEGER:0
authorityInfoAccess = caIssuers;URI:http://$CRLAIA/$CANAME.cer,OCSP;URI:http://$CRLAIA/ocsp/$CANAME
crlDistributionPoints = URI:http://$CRLAIA/$CANAME.crl
[ ext_client ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
#nsCertType = email, client
basicConstraints = critical, CA:false
extendedKeyUsage = critical, clientAuth, emailProtection, msSmartcardLogin
keyUsage = digitalSignature, keyEncipherment
#email:<mailaddress>, otherName:msUPN;UTF8:<upn>
subjectAltName = $SAN
authorityKeyIdentifier = keyid,issuer
authorityInfoAccess = caIssuers;URI:http://$CRLAIA/$CANAME.cer,OCSP;URI:http://$CRLAIA/ocsp/$CANAME
crlDistributionPoints = URI:http://$CRLAIA/$CANAME.crl
[ ext_server ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
extendedKeyUsage = critical, serverAuth , clientAuth
keyUsage = digitalSignature, keyEncipherment
#DNS:<fqdn or wildcard>, IP:<ip>, ....
subjectAltName = $SAN
authorityKeyIdentifier = keyid,issuer
authorityInfoAccess = caIssuers;URI:http://$CRLAIA/$CANAME.cer,OCSP;URI:http://$CRLAIA/ocsp/$CANAME
crlDistributionPoints = URI:http://$CRLAIA/$CANAME.crl
#EV SSL
#policyConstraints =
[ ext_ocsp ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = OCSPSigning
[ ext_client_ms ]
#以下のエクステンションがMSのクライアント証明書特有かもしれないが、おそらくいらない。
MS_CERTIFICATE_TEMPLATE = DER:302E06262B060104018237150885F88F1C86FED61787A98F0986F48C1F81D38F094B87B49405839DA83502016402010D
MS_APPLICATION_CERT_POLICIES = DER:3026300C060A2B060104018237140202300A06082B06010505070302300A06082B06010505070304
SMIME-CAPS = DER:3035300E06082A864886F70D030202020080300E06082A864886F70D030402020080300706052B0E030207300A06082A864886F70D0307
[ ext_fido ]
basicConstraints = critical,CA:FALSE
# カプセル化しない FORMAT:ASCII,OCT:1.3.6.1.4.1.41482.1.7
YUBIKEY_DEVICE_ID = DER:312e332e362e312e342e312e34313438322e312e37
# https://support.yubico.com/support/solutions/articles/15000028710-yubikey-hardware-fido2-aaguids
# yubikey 5.1
ID_FIDO_GEN_CE_AAGUID = ASN1:FORMAT:HEX,OCT:CB69481E8FF7403993EC0A2729A154A8
# https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-u2f-authenticator-transports-extension-v1.2-ps-20170411.html
# 3.2.1 FIDO U2F certificate transports extension
# uSB(2) のみセット
ID_FIDO_U2F_CE_TRANSPORTS = ASN1:FORMAT:BITLIST,BITSTRING:2
authorityKeyIdentifier = keyid,issuer
authorityInfoAccess = caIssuers;URI:http://$CRLAIA/$CANAME.cer,OCSP;URI:http://$CRLAIA/ocsp/$CANAME
crlDistributionPoints = URI:http://$CRLAIA/$CANAME.crl
[ crl_ext ]
authorityKeyIdentifier=keyid:always