http://cocnm.computerisms.ca/index.php?action=history&feed=atom&title=%2Fvar%2FCA%2Fcomputerisms.com%2Fcomputerisms.ssl.conf /var/CA/computerisms.com/computerisms.ssl.conf - Revision history 2026-11-14T11:55:50Z Revision history for this page on the wiki MediaWiki 1.41.0 http://cocnm.computerisms.ca/index.php?title=/var/CA/computerisms.com/computerisms.ssl.conf&diff=440&oldid=prev Bob at 18:11, 10 June 2015 2015-06-10T18:11:12Z <p></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 18:11, 10 June 2015</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l84">Line 84:</td> <td colspan="2" class="diff-lineno">Line 84:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>basicConstraints = CA:FALSE</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>basicConstraints = CA:FALSE</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>#keyUsage = nonRepudiation, digitalSignature, keyEncipherment ##Use this line for everything except CAs  </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>#keyUsage = nonRepudiation, digitalSignature, keyEncipherment ##Use this line for everything except CAs  </div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">#extendedKeyUsage              = serverAuth ## Enable this line for VPN firewall certs</ins></div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>keyUsage                        = nonRepudiation, digitalSignature, keyEncipherment, keyCertSign, cRLSign      ## Use this line for CAs</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>keyUsage                        = nonRepudiation, digitalSignature, keyEncipherment, keyCertSign, cRLSign      ## Use this line for CAs</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>[ v3_ca ]</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>[ v3_ca ]</div></td></tr> </table> Bob http://cocnm.computerisms.ca/index.php?title=/var/CA/computerisms.com/computerisms.ssl.conf&diff=171&oldid=prev Bob: 1 revision 2013-09-19T06:19:57Z <p>1 revision</p> <p><b>New page</b></p><div>&lt;pre&gt;<br /> HOME = .<br /> RANDFILE = $ENV::HOME/.rnd<br /> oid_section = new_oids<br /> [ new_oids ]<br /> [ ca ]<br /> default_ca = CA_default # The default ca section<br /> [ CA_default ]<br /> dir = ./CA # Where everything is kept<br /> certs = $dir/certs # Where the issued certs are kept<br /> crl_dir = $dir/crl # Where the issued crl are kept<br /> database = $dir/index.txt # database index file.<br /> new_certs_dir = $dir/newcerts # default place for new certs.<br /> certificate = $dir/cacert.pem # The CA certificate<br /> serial = $dir/serial # The current serial number<br /> crlnumber = $dir/crlnumber # the current crl number<br /> crl = $dir/crl.pem # The current CRL<br /> private_key = $dir/private/cakey.pem # The private key<br /> RANDFILE = $dir/private/.rand # private random number file<br /> x509_extensions = usr_cert # The extentions to add to the cert<br /> name_opt = ca_default # Subject Name options<br /> cert_opt = ca_default # Certificate field options<br /> crl_extensions = crl_ext<br /> default_days = 3650 # how long to certify for<br /> default_crl_days = 10 # how long before next CRL<br /> default_md = sha1 # which md to use.<br /> preserve = no # keep passed DN ordering<br /> policy = policy_match<br /> copy_extensions = copy<br /> [ policy_match ]<br /> countryName = match<br /> stateOrProvinceName = match<br /> organizationName = match<br /> organizationalUnitName = optional<br /> commonName = supplied<br /> emailAddress = optional<br /> [ policy_anything ]<br /> countryName = optional<br /> stateOrProvinceName = optional<br /> localityName = optional<br /> organizationName = optional<br /> organizationalUnitName = optional<br /> commonName = supplied<br /> emailAddress = optional<br /> [ req ]<br /> default_bits = 4096<br /> default_keyfile = privkey.pem<br /> distinguished_name = req_distinguished_name<br /> attributes = req_attributes<br /> x509_extensions = v3_ca # The extentions to add to the self signed cert<br /> string_mask = default <br /> req_extensions = v3_req # The extensions to add to a certificate request<br /> [ req_distinguished_name ]<br /> countryName = Country Name (2 letter code)<br /> countryName_default = CA<br /> countryName_min = 2<br /> countryName_max = 2<br /> stateOrProvinceName = State or Province Name (full name)<br /> stateOrProvinceName_default = Yukon<br /> localityName = Locality Name (eg, city)<br /> localityName_default = Whitehorse<br /> 0.organizationName = Organization Name (eg, company)<br /> 0.organizationName_default = Computerisms<br /> organizationalUnitName = Organizational Unit Name (eg, section)<br /> organizationalUnitName_default = Administrator<br /> commonName = Common Name (eg, YOUR name)<br /> commonName_max = 64<br /> emailAddress = Email Address<br /> emailAddress_max = 64<br /> [ req_attributes ]<br /> [ usr_cert ]<br /> basicConstraints = CA:FALSE<br /> subjectKeyIdentifier = hash<br /> authorityKeyIdentifier = keyid,issuer<br /> crlDistributionPoints = URI:http://crl.computerisms.com/Computerisms.Certificate.Authority.crl<br /> [ usr_cert_has_san ]<br /> basicConstraints = CA:FALSE<br /> subjectKeyIdentifier = hash<br /> authorityKeyIdentifier = keyid,issuer<br /> crlDistributionPoints = URI:http://crl.computerisms.com/Computerisms.Certificate.Authority.crl<br /> [ v3_req ]<br /> #subjectAltName = DNS:fqdn.computerisms.com ## use this for machines<br /> subjectAltName = email:move ## use this for CA or person<br /> basicConstraints = CA:FALSE<br /> #keyUsage = nonRepudiation, digitalSignature, keyEncipherment ##Use this line for everything except CAs <br /> keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyCertSign, cRLSign ## Use this line for CAs<br /> [ v3_ca ]<br /> subjectAltName = email:move<br /> subjectKeyIdentifier = hash<br /> authorityKeyIdentifier = keyid:always,issuer:always<br /> basicConstraints = CA:true<br /> crlDistributionPoints = URI:http://crl.computerisms.com/Computerisms.Certificate.Authority.crl<br /> [ v3_ca_has_san ]<br /> subjectKeyIdentifier = hash<br /> authorityKeyIdentifier = keyid:always,issuer:always<br /> basicConstraints = CA:true<br /> crlDistributionPoints = URI:http://crl.computerisms.com/Computerisms.Certificate.Authority.crl<br /> [ crl_ext ]<br /> authorityKeyIdentifier = keyid:always,issuer:always<br /> &lt;/pre&gt;</div> Bob