From beaba32a3be4a25a341557ed397a6641501153e3 Mon Sep 17 00:00:00 2001 From: Timothy Pearson Date: Thu, 5 Oct 2017 14:59:25 -0500 Subject: Second half of rebrand --- src/etc/pfSense-rc | 2 +- .../ascii-art/raptorguard-logo-small.txt | 5 + .../local/share/RaptorGuard/iso_3166-1_list_en.xml | 987 +++++++++++++++++++++ .../share/RaptorGuard/keys/pkg/revoked/.empty | 0 .../keys/pkg/trusted/beta.pfsense.org.20151223 | 2 + .../pkg.guard.raptorengineering.com.20171005 | 2 + .../keys/pkg/trusted/pkg.pfsense.org.20160406 | 2 + src/usr/local/share/RaptorGuard/ssl/openssl.cnf | 393 ++++++++ 8 files changed, 1392 insertions(+), 1 deletion(-) create mode 100644 src/usr/local/share/RaptorGuard/ascii-art/raptorguard-logo-small.txt create mode 100644 src/usr/local/share/RaptorGuard/iso_3166-1_list_en.xml create mode 100644 src/usr/local/share/RaptorGuard/keys/pkg/revoked/.empty create mode 100644 src/usr/local/share/RaptorGuard/keys/pkg/trusted/beta.pfsense.org.20151223 create mode 100644 src/usr/local/share/RaptorGuard/keys/pkg/trusted/pkg.guard.raptorengineering.com.20171005 create mode 100644 src/usr/local/share/RaptorGuard/keys/pkg/trusted/pkg.pfsense.org.20160406 create mode 100644 src/usr/local/share/RaptorGuard/ssl/openssl.cnf diff --git a/src/etc/pfSense-rc b/src/etc/pfSense-rc index 09683ae..8b2cb36 100755 --- a/src/etc/pfSense-rc +++ b/src/etc/pfSense-rc @@ -215,7 +215,7 @@ if [ "${USE_MFS_TMPVAR}" != "true" ]; then fi echo -cat /usr/local/share/pfSense/ascii-art/pfsense-logo-small.txt +cat /usr/local/share/RaptorGuard/ascii-art/raptorguard-logo-small.txt echo echo echo "Welcome to ${product} ${version}${version_patch}..." diff --git a/src/usr/local/share/RaptorGuard/ascii-art/raptorguard-logo-small.txt b/src/usr/local/share/RaptorGuard/ascii-art/raptorguard-logo-small.txt new file mode 100644 index 0000000..6c56fd3 --- /dev/null +++ b/src/usr/local/share/RaptorGuard/ascii-art/raptorguard-logo-small.txt @@ -0,0 +1,5 @@ + | +Raptor | + | + | Guard + | diff --git a/src/usr/local/share/RaptorGuard/iso_3166-1_list_en.xml b/src/usr/local/share/RaptorGuard/iso_3166-1_list_en.xml new file mode 100644 index 0000000..44c5a62 --- /dev/null +++ b/src/usr/local/share/RaptorGuard/iso_3166-1_list_en.xml @@ -0,0 +1,987 @@ + + + + AFGHANISTAN + AF + + + ÅLAND ISLANDS + AX + + + ALBANIA + AL + + + ALGERIA + DZ + + + AMERICAN SAMOA + AS + + + ANDORRA + AD + + + ANGOLA + AO + + + ANGUILLA + AI + + + ANTARCTICA + AQ + + + ANTIGUA AND BARBUDA + AG + + + ARGENTINA + AR + + + ARMENIA + AM + + + ARUBA + AW + + + AUSTRALIA + AU + + + AUSTRIA + AT + + + AZERBAIJAN + AZ + + + BAHAMAS + BS + + + BAHRAIN + BH + + + BANGLADESH + BD + + + BARBADOS + BB + + + BELARUS + BY + + + BELGIUM + BE + + + BELIZE + BZ + + + BENIN + BJ + + + BERMUDA + BM + + + BHUTAN + BT + + + BOLIVIA, PLURINATIONAL STATE OF + BO + + + BOSNIA AND HERZEGOVINA + BA + + + BOTSWANA + BW + + + BOUVET ISLAND + BV + + + BRAZIL + BR + + + BRITISH INDIAN OCEAN TERRITORY + IO + + + BRUNEI DARUSSALAM + BN + + + BULGARIA + BG + + + BURKINA FASO + BF + + + BURUNDI + BI + + + CAMBODIA + KH + + + CAMEROON + CM + + + CANADA + CA + + + CAPE VERDE + CV + + + CAYMAN ISLANDS + KY + + + CENTRAL AFRICAN REPUBLIC + CF + + + CHAD + TD + + + CHILE + CL + + + CHINA + CN + + + CHRISTMAS ISLAND + CX + + + COCOS (KEELING) ISLANDS + CC + + + COLOMBIA + CO + + + COMOROS + KM + + + CONGO + CG + + + CONGO, THE DEMOCRATIC REPUBLIC OF THE + CD + + + COOK ISLANDS + CK + + + COSTA RICA + CR + + + CÔTE D'IVOIRE + CI + + + CROATIA + HR + + + CUBA + CU + + + CYPRUS + CY + + + CZECH REPUBLIC + CZ + + + DENMARK + DK + + + DJIBOUTI + DJ + + + DOMINICA + DM + + + DOMINICAN REPUBLIC + DO + + + ECUADOR + EC + + + EGYPT + EG + + + EL SALVADOR + SV + + + EQUATORIAL GUINEA + GQ + + + ERITREA + ER + + + ESTONIA + EE + + + ETHIOPIA + ET + + + FALKLAND ISLANDS (MALVINAS) + FK + + + FAROE ISLANDS + FO + + + FIJI + FJ + + + FINLAND + FI + + + FRANCE + FR + + + FRENCH GUIANA + GF + + + FRENCH POLYNESIA + PF + + + FRENCH SOUTHERN TERRITORIES + TF + + + GABON + GA + + + GAMBIA + GM + + + GEORGIA + GE + + + GERMANY + DE + + + GHANA + GH + + + GIBRALTAR + GI + + + GREECE + GR + + + GREENLAND + GL + + + GRENADA + GD + + + GUADELOUPE + GP + + + GUAM + GU + + + GUATEMALA + GT + + + GUERNSEY + GG + + + GUINEA + GN + + + GUINEA-BISSAU + GW + + + GUYANA + GY + + + HAITI + HT + + + HEARD ISLAND AND MCDONALD ISLANDS + HM + + + HOLY SEE (VATICAN CITY STATE) + VA + + + HONDURAS + HN + + + HONG KONG + HK + + + HUNGARY + HU + + + ICELAND + IS + + + INDIA + IN + + + INDONESIA + ID + + + IRAN, ISLAMIC REPUBLIC OF + IR + + + IRAQ + IQ + + + IRELAND + IE + + + ISLE OF MAN + IM + + + ISRAEL + IL + + + ITALY + IT + + + JAMAICA + JM + + + JAPAN + JP + + + JERSEY + JE + + + JORDAN + JO + + + KAZAKHSTAN + KZ + + + KENYA + KE + + + KIRIBATI + KI + + + KOREA, DEMOCRATIC PEOPLE'S REPUBLIC OF + KP + + + KOREA, REPUBLIC OF + KR + + + KUWAIT + KW + + + KYRGYZSTAN + KG + + + LAO PEOPLE'S DEMOCRATIC REPUBLIC + LA + + + LATVIA + LV + + + LEBANON + LB + + + LESOTHO + LS + + + LIBERIA + LR + + + LIBYAN ARAB JAMAHIRIYA + LY + + + LIECHTENSTEIN + LI + + + LITHUANIA + LT + + + LUXEMBOURG + LU + + + MACAO + MO + + + MACEDONIA, THE FORMER YUGOSLAV REPUBLIC OF + MK + + + MADAGASCAR + MG + + + MALAWI + MW + + + MALAYSIA + MY + + + MALDIVES + MV + + + MALI + ML + + + MALTA + MT + + + MARSHALL ISLANDS + MH + + + MARTINIQUE + MQ + + + MAURITANIA + MR + + + MAURITIUS + MU + + + MAYOTTE + YT + + + MEXICO + MX + + + MICRONESIA, FEDERATED STATES OF + FM + + + MOLDOVA, REPUBLIC OF + MD + + + MONACO + MC + + + MONGOLIA + MN + + + MONTENEGRO + ME + + + MONTSERRAT + MS + + + MOROCCO + MA + + + MOZAMBIQUE + MZ + + + MYANMAR + MM + + + NAMIBIA + NA + + + NAURU + NR + + + NEPAL + NP + + + NETHERLANDS + NL + + + NETHERLANDS ANTILLES + AN + + + NEW CALEDONIA + NC + + + NEW ZEALAND + NZ + + + NICARAGUA + NI + + + NIGER + NE + + + NIGERIA + NG + + + NIUE + NU + + + NORFOLK ISLAND + NF + + + NORTHERN MARIANA ISLANDS + MP + + + NORWAY + NO + + + OMAN + OM + + + PAKISTAN + PK + + + PALAU + PW + + + PALESTINIAN TERRITORY, OCCUPIED + PS + + + PANAMA + PA + + + PAPUA NEW GUINEA + PG + + + PARAGUAY + PY + + + PERU + PE + + + PHILIPPINES + PH + + + PITCAIRN + PN + + + POLAND + PL + + + PORTUGAL + PT + + + PUERTO RICO + PR + + + QATAR + QA + + + REUNION + RE + + + ROMANIA + RO + + + RUSSIAN FEDERATION + RU + + + RWANDA + RW + + + SAINT BARTHÉLEMY + BL + + + SAINT HELENA, ASCENSION AND TRISTAN DA CUNHA + SH + + + SAINT KITTS AND NEVIS + KN + + + SAINT LUCIA + LC + + + SAINT MARTIN + MF + + + SAINT PIERRE AND MIQUELON + PM + + + SAINT VINCENT AND THE GRENADINES + VC + + + SAMOA + WS + + + SAN MARINO + SM + + + SAO TOME AND PRINCIPE + ST + + + SAUDI ARABIA + SA + + + SENEGAL + SN + + + SERBIA + RS + + + SEYCHELLES + SC + + + SIERRA LEONE + SL + + + SINGAPORE + SG + + + SLOVAKIA + SK + + + SLOVENIA + SI + + + SOLOMON ISLANDS + SB + + + SOMALIA + SO + + + SOUTH AFRICA + ZA + + + SOUTH GEORGIA AND THE SOUTH SANDWICH ISLANDS + GS + + + SPAIN + ES + + + SRI LANKA + LK + + + SUDAN + SD + + + SURINAME + SR + + + SVALBARD AND JAN MAYEN + SJ + + + SWAZILAND + SZ + + + SWEDEN + SE + + + SWITZERLAND + CH + + + SYRIAN ARAB REPUBLIC + SY + + + TAIWAN, PROVINCE OF CHINA + TW + + + TAJIKISTAN + TJ + + + TANZANIA, UNITED REPUBLIC OF + TZ + + + THAILAND + TH + + + TIMOR-LESTE + TL + + + TOGO + TG + + + TOKELAU + TK + + + TONGA + TO + + + TRINIDAD AND TOBAGO + TT + + + TUNISIA + TN + + + TURKEY + TR + + + TURKMENISTAN + TM + + + TURKS AND CAICOS ISLANDS + TC + + + TUVALU + TV + + + UGANDA + UG + + + UKRAINE + UA + + + UNITED ARAB EMIRATES + AE + + + UNITED KINGDOM + GB + + + UNITED STATES + US + + + UNITED STATES MINOR OUTLYING ISLANDS + UM + + + URUGUAY + UY + + + UZBEKISTAN + UZ + + + VANUATU + VU + + + VENEZUELA, BOLIVARIAN REPUBLIC OF + VE + + + VIET NAM + VN + + + VIRGIN ISLANDS, BRITISH + VG + + + VIRGIN ISLANDS, U.S. + VI + + + WALLIS AND FUTUNA + WF + + + WESTERN SAHARA + EH + + + YEMEN + YE + + + ZAMBIA + ZM + + + ZIMBABWE + ZW + + diff --git a/src/usr/local/share/RaptorGuard/keys/pkg/revoked/.empty b/src/usr/local/share/RaptorGuard/keys/pkg/revoked/.empty new file mode 100644 index 0000000..e69de29 diff --git a/src/usr/local/share/RaptorGuard/keys/pkg/trusted/beta.pfsense.org.20151223 b/src/usr/local/share/RaptorGuard/keys/pkg/trusted/beta.pfsense.org.20151223 new file mode 100644 index 0000000..6a7f38b --- /dev/null +++ b/src/usr/local/share/RaptorGuard/keys/pkg/trusted/beta.pfsense.org.20151223 @@ -0,0 +1,2 @@ +function: sha256 +fingerprint: 39a1374f4a4fc9a45d16c31dde75b6ef8511b6abfeb314d44fcb847bc9ea9a31 diff --git a/src/usr/local/share/RaptorGuard/keys/pkg/trusted/pkg.guard.raptorengineering.com.20171005 b/src/usr/local/share/RaptorGuard/keys/pkg/trusted/pkg.guard.raptorengineering.com.20171005 new file mode 100644 index 0000000..d911ab7 --- /dev/null +++ b/src/usr/local/share/RaptorGuard/keys/pkg/trusted/pkg.guard.raptorengineering.com.20171005 @@ -0,0 +1,2 @@ +function: sha256 +fingerprint: 3d92795002cba237188f78af6b85468e7fe76d4faf4689f518cd374cb53c5c43 diff --git a/src/usr/local/share/RaptorGuard/keys/pkg/trusted/pkg.pfsense.org.20160406 b/src/usr/local/share/RaptorGuard/keys/pkg/trusted/pkg.pfsense.org.20160406 new file mode 100644 index 0000000..940663f --- /dev/null +++ b/src/usr/local/share/RaptorGuard/keys/pkg/trusted/pkg.pfsense.org.20160406 @@ -0,0 +1,2 @@ +function: sha256 +fingerprint: 30be9cc2e7b2b3ba1ff3b2be1795f3f0719ab9a65322695703dc7b8f004035a8 diff --git a/src/usr/local/share/RaptorGuard/ssl/openssl.cnf b/src/usr/local/share/RaptorGuard/ssl/openssl.cnf new file mode 100644 index 0000000..a353e2f --- /dev/null +++ b/src/usr/local/share/RaptorGuard/ssl/openssl.cnf @@ -0,0 +1,393 @@ +# $FreeBSD$ +# +# OpenSSL example configuration file. +# This is mostly being used for generation of certificate requests. +# + +# This definition stops the following lines choking if HOME isn't +# defined. +HOME = . +RANDFILE = $ENV::HOME/.rnd + +# pfSense: default SAN value if $ENV::SAN is not defined +# +SAN = + +# Extra OBJECT IDENTIFIER info: +#oid_file = $ENV::HOME/.oid +oid_section = new_oids + +# To use this configuration file with the "-extfile" option of the +# "openssl x509" utility, name here the section containing the +# X.509v3 extensions to use: +# extensions = +# (Alternatively, use a configuration file that has only +# X.509v3 extensions in its main [= default] section.) + +[ new_oids ] + +# We can add new OIDs in here for use by 'ca', 'req' and 'ts'. +# Add a simple OID like this: +# testoid1=1.2.3.4 +# Or use config file substitution like this: +# testoid2=${testoid1}.5.6 + +# Policies used by the TSA examples. +tsa_policy1 = 1.2.3.4.1 +tsa_policy2 = 1.2.3.4.5.6 +tsa_policy3 = 1.2.3.4.5.7 + +#################################################################### +[ ca ] +default_ca = CA_default # The default ca section + +#################################################################### +[ CA_default ] + +dir = ./demoCA # Where everything is kept +certs = $dir/certs # Where the issued certs are kept +crl_dir = $dir/crl # Where the issued crl are kept +database = $dir/index.txt # database index file. +#unique_subject = no # Set to 'no' to allow creation of + # several ctificates with same subject. +new_certs_dir = $dir/newcerts # default place for new certs. + +certificate = $dir/cacert.pem # The CA certificate +serial = $dir/serial # The current serial number +crlnumber = $dir/crlnumber # the current crl number + # must be commented out to leave a V1 CRL +crl = $dir/crl.pem # The current CRL +private_key = $dir/private/cakey.pem# The private key +RANDFILE = $dir/private/.rand # private random number file + +x509_extensions = usr_cert # The extentions to add to the cert + +# Comment out the following two lines for the "traditional" +# (and highly broken) format. +name_opt = ca_default # Subject Name options +cert_opt = ca_default # Certificate field options + +# Extension copying option: use with caution. +# copy_extensions = copy + +# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs +# so this is commented out by default to leave a V1 CRL. +# crlnumber must also be commented out to leave a V1 CRL. +crl_extensions = crl_ext + +default_days = 365 # how long to certify for +default_crl_days= 30 # how long before next CRL +default_md = default # use public key default MD +preserve = no # keep passed DN ordering + +# A few difference way of specifying how similar the request should look +# For type CA, the listed attributes must be the same, and the optional +# and supplied fields are just that :-) +policy = policy_match + +# For the CA policy +[ policy_match ] +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +# For the 'anything' policy +# At this point in time, you must list all acceptable 'object' +# types. +[ policy_anything ] +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +#################################################################### +[ req ] +prompt = no +default_bits = 2048 +default_keyfile = privkey.pem +distinguished_name = req_distinguished_name +attributes = req_attributes +x509_extensions = v3_ca # The extentions to add to the self signed cert + +# Passwords for private keys if not present they will be prompted for +# input_password = secret +# output_password = secret + +# This sets a mask for permitted string types. There are several options. +# default: PrintableString, T61String, BMPString. +# pkix : PrintableString, BMPString (PKIX recommendation before 2004) +# utf8only: only UTF8Strings (PKIX recommendation after 2004). +# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings). +# MASK:XXXX a literal mask value. +# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings. +string_mask = nombstr + +req_extensions = v3_req # The extensions to add to a certificate request + +[ req_distinguished_name ] +countryName = Country Name (2 letter code) +countryName_default = AU +countryName_min = 2 +countryName_max = 2 + +stateOrProvinceName = State or Province Name (full name) +stateOrProvinceName_default = Some-State + +localityName = Locality Name (eg, city) + +0.organizationName = Organization Name (eg, company) +0.organizationName_default = Internet Widgits Pty Ltd + +# we can do this but it is not needed normally :-) +#1.organizationName = Second Organization Name (eg, company) +#1.organizationName_default = World Wide Web Pty Ltd + +organizationalUnitName = Organizational Unit Name (eg, section) +#organizationalUnitName_default = + +commonName = Common Name (e.g. server FQDN or YOUR name) +commonName_max = 64 + +emailAddress = Email Address +emailAddress_max = 64 + +# SET-ex3 = SET extension number 3 + +[ req_attributes ] +challengePassword = A challenge password +challengePassword_min = 4 +challengePassword_max = 20 + +unstructuredName = An optional company name + +[ usr_cert ] + +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment +nsComment = "OpenSSL Generated User Certificate" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer:always +extendedKeyUsage = clientAuth + +[ usr_cert_san ] + +# copy of [ usr_cert ] plus nonempty Subject Alternative Names +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment +nsComment = "OpenSSL Generated User Certificate" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer:always +extendedKeyUsage = clientAuth +subjectAltName = $ENV::SAN + +[ server ] + +# Make a cert with nsCertType=server +basicConstraints = CA:FALSE +nsCertType = server +keyUsage = digitalSignature, keyEncipherment +nsComment = "OpenSSL Generated Server Certificate" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer:always +extendedKeyUsage = serverAuth,1.3.6.1.5.5.8.2.2 + +[ server_san ] + +# copy of [ server ] plus nonempty Subject Alternative Names +basicConstraints = CA:FALSE +nsCertType = server +keyUsage = digitalSignature, keyEncipherment +nsComment = "OpenSSL Generated Server Certificate" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer:always +extendedKeyUsage = serverAuth,1.3.6.1.5.5.8.2.2 +subjectAltName = $ENV::SAN + +[ req_usr_cert ] + +# Copy of [ usr_cert ] for CSR +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment +nsComment = "OpenSSL Generated User Certificate" +subjectKeyIdentifier = hash +extendedKeyUsage = clientAuth + +[ req_usr_cert_san ] + +# Copy of [ usr_cert_san ] for CSR +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment +nsComment = "OpenSSL Generated User Certificate" +subjectKeyIdentifier = hash +extendedKeyUsage = clientAuth +subjectAltName = $ENV::SAN + +[ req_server ] + +# Copy of [ server ] for CSR +basicConstraints = CA:FALSE +nsCertType = server +keyUsage = digitalSignature, keyEncipherment +nsComment = "OpenSSL Generated Server Certificate" +subjectKeyIdentifier = hash +extendedKeyUsage = serverAuth,1.3.6.1.5.5.8.2.2 + +[ req_server_san ] + +# Copy of [ server_san ] for CSR +basicConstraints = CA:FALSE +nsCertType = server +keyUsage = digitalSignature, keyEncipherment +nsComment = "OpenSSL Generated Server Certificate" +subjectKeyIdentifier = hash +extendedKeyUsage = serverAuth,1.3.6.1.5.5.8.2.2 +subjectAltName = $ENV::SAN + +[ v3_req ] + +# Extensions to add to a certificate request + +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment + + +[ v3_ca ] + +# Extensions for a typical CA + + +# PKIX recommendation. + +subjectKeyIdentifier=hash + +authorityKeyIdentifier=keyid:always,issuer:always + +# This is what PKIX recommends but some broken software chokes on critical +# extensions. +#basicConstraints = critical,CA:true +# So we do this instead. +basicConstraints = CA:true + +# Key usage: this is typical for a CA certificate. However since it will +# prevent it being used as an test self-signed certificate it is best +# left out by default. +keyUsage = cRLSign, keyCertSign + +# Some might want this also +# nsCertType = sslCA, emailCA + +# Include email address in subject alt name: another PKIX recommendation +# subjectAltName=email:copy +# Copy issuer details +# issuerAltName=issuer:copy + +# DER hex encoding of an extension: beware experts only! +# obj=DER:02:03 +# Where 'obj' is a standard or added object +# You can even override a supported extension: +# basicConstraints= critical, DER:30:03:01:01:FF + +[ v3_ca_san ] + +# copy of [ v3_ca ] plus nonempty Subject Alternative Names +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid:always,issuer:always +basicConstraints=CA:true +subjectAltName=$ENV::SAN + +[ crl_ext ] + +# CRL extensions. +# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL. + +# issuerAltName=issuer:copy +authorityKeyIdentifier=keyid:always,issuer:always + +[ proxy_cert_ext ] +# These extensions should be added when creating a proxy certificate + +# This goes against PKIX guidelines but some CAs do it and some software +# requires this to avoid interpreting an end user certificate as a CA. + +basicConstraints=CA:FALSE + +# Here are some examples of the usage of nsCertType. If it is omitted +# the certificate can be used for anything *except* object signing. + +# This is OK for an SSL server. +# nsCertType = server + +# For an object signing certificate this would be used. +# nsCertType = objsign + +# For normal client use this is typical +# nsCertType = client, email + +# and for everything including object signing: +# nsCertType = client, email, objsign + +# This is typical in keyUsage for a client certificate. +# keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +# This will be displayed in Netscape's comment listbox. +nsComment = "OpenSSL Generated Certificate" + +# PKIX recommendations harmless if included in all certificates. +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid,issuer + +# This stuff is for subjectAltName and issuerAltname. +# Import the email address. +# subjectAltName=email:copy +# An alternative to produce certificates that aren't +# deprecated according to PKIX. +# subjectAltName=email:move + +# Copy subject details +# issuerAltName=issuer:copy + +#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem +#nsBaseUrl +#nsRevocationUrl +#nsRenewalUrl +#nsCaPolicyUrl +#nsSslServerName + +# This really needs to be in place for it to be a proxy certificate. +proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo + +#################################################################### +[ tsa ] + +default_tsa = tsa_config1 # the default TSA section + +[ tsa_config1 ] + +# These are used by the TSA reply generation only. +dir = ./demoCA # TSA root directory +serial = $dir/tsaserial # The current serial number (mandatory) +crypto_device = builtin # OpenSSL engine to use for signing +signer_cert = $dir/tsacert.pem # The TSA signing certificate + # (optional) +certs = $dir/cacert.pem # Certificate chain to include in reply + # (optional) +signer_key = $dir/private/tsakey.pem # The TSA private key (optional) + +default_policy = tsa_policy1 # Policy if request did not specify it + # (optional) +other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional) +digests = md5, sha1 # Acceptable message digests (mandatory) +accuracy = secs:1, millisecs:500, microsecs:100 # (optional) +clock_precision_digits = 0 # number of digits after dot. (optional) +ordering = yes # Is ordering defined for timestamps? + # (optional, default: no) +tsa_name = yes # Must the TSA name be included in the reply? + # (optional, default: no) +ess_cert_id_chain = no # Must the ESS cert id chain be included? + # (optional, default: no) -- cgit v1.1