cacert/community-website
9
0
Fork 0
Code Issues Pull requests Wiki Activity
community-website/ca.cnf

141 lines
4 KiB
Text
Raw Normal View History

Add signer backend This commit adds a simple go backend calling openssl ca to sign CRS coming from the client. The JavaScript code in src/index.html has been extended to send requests to the sign endpoint and display the resulting certificate in a separate div element. A script setup_example_ca.sh and an openssl configuration file ca.cnf has been added to allow quick setup of a simple example CA.
2020-11-29 23:08:05 +00:00
extensions = v3_ext
[ca]
Setup more CAB forum compliant CA structure
2020-12-16 06:20:42 +00:00
default_ca = sub_ca
Add signer backend This commit adds a simple go backend calling openssl ca to sign CRS coming from the client. The JavaScript code in src/index.html has been extended to send requests to the sign endpoint and display the resulting certificate in a separate div element. A script setup_example_ca.sh and an openssl configuration file ca.cnf has been added to allow quick setup of a simple example CA.
2020-11-29 23:08:05 +00:00
Improve example CA setup The example CA now has more realistic 2 levels with a root CA and a sub CA. Setup script and ca.cnf has been changed to create a root CA and a sub CA that is signed by the root CA. The sub CA is used for signing the end entity certificates. Example CA directory has been changed to example_ca for better readability.
2020-12-05 18:48:34 +00:00
[rootca]
dir = ./example_ca/root
certs = $dir/certs
crl_dir = $dir/crl
database = $dir/index.txt
serial = $dir/serial
new_certs_dir = $dir/newcerts
crl = $dir/crl.pem
certificate = $dir/ca.crt.pem
private_key = $dir/private/ca.key.pem
RANDFILE = $dir/private/.rand
policy = policy_any
unique_subject = no
email_in_dn = no
copy_extensions = none
default_md = sha256
default_days = 1825
default_crl_days = 30
Setup more CAB forum compliant CA structure
2020-12-16 06:20:42 +00:00
[sub_ca]
Improve example CA setup The example CA now has more realistic 2 levels with a root CA and a sub CA. Setup script and ca.cnf has been changed to create a root CA and a sub CA that is signed by the root CA. The sub CA is used for signing the end entity certificates. Example CA directory has been changed to example_ca for better readability.
2020-12-05 18:48:34 +00:00
dir = ./example_ca/sub
certs = $dir/certs
crl_dir = $dir/crl
database = $dir/index.txt
serial = $dir/serial
new_certs_dir = $dir/newcerts
crl = $dir/crl.pem
certificate = $dir/ca.crt.pem
private_key = $dir/private/ca.key.pem
RANDFILE = $dir/private/.rand
unique_subject = no
email_in_dn = no
default_md = sha256
default_days = 365
default_crl_days = 30
Setup more CAB forum compliant CA structure
2020-12-16 06:20:42 +00:00
[email_ca]
dir = ./example_ca/email
certs = $dir/certs
crl_dir = $dir/crl
database = $dir/index.txt
serial = $dir/serial
new_certs_dir = $dir/newcerts
crl = $dir/crl.pem
certificate = $dir/ca.crt.pem
private_key = $dir/private/ca.key.pem
RANDFILE = $dir/private/.rand
unique_subject = no
email_in_dn = no
default_md = sha256
default_days = 365
default_crl_days = 30
Improve example CA setup The example CA now has more realistic 2 levels with a root CA and a sub CA. Setup script and ca.cnf has been changed to create a root CA and a sub CA that is signed by the root CA. The sub CA is used for signing the end entity certificates. Example CA directory has been changed to example_ca for better readability.
2020-12-05 18:48:34 +00:00
[policy_any]
countryName = match
stateOrProvinceName = optional
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
Add signer backend This commit adds a simple go backend calling openssl ca to sign CRS coming from the client. The JavaScript code in src/index.html has been extended to send requests to the sign endpoint and display the resulting certificate in a separate div element. A script setup_example_ca.sh and an openssl configuration file ca.cnf has been added to allow quick setup of a simple example CA.
2020-11-29 23:08:05 +00:00
[policy_match]
commonName = supplied
Setup more CAB forum compliant CA structure
2020-12-16 06:20:42 +00:00
[email_ext]
Add signer backend This commit adds a simple go backend calling openssl ca to sign CRS coming from the client. The JavaScript code in src/index.html has been extended to send requests to the sign endpoint and display the resulting certificate in a separate div element. A script setup_example_ca.sh and an openssl configuration file ca.cnf has been added to allow quick setup of a simple example CA.
2020-11-29 23:08:05 +00:00
basicConstraints = critical,CA:false
keyUsage = keyEncipherment,digitalSignature,nonRepudiation
extendedKeyUsage = clientAuth,emailProtection
subjectKeyIdentifier = hash
Setup more CAB forum compliant CA structure
2020-12-16 06:20:42 +00:00
authorityKeyIdentifier = keyid:always
authorityInfoAccess = 1.3.6.1.5.5.7.48.2;URI:http://example.org/ca/root/ca.crt,OCSP;URI:http://ocsp.example.org/
crlDistributionPoints = URI:http://crl.example.org/email.crl
Improve example CA setup The example CA now has more realistic 2 levels with a root CA and a sub CA. Setup script and ca.cnf has been changed to create a root CA and a sub CA that is signed by the root CA. The sub CA is used for signing the end entity certificates. Example CA directory has been changed to example_ca for better readability.
2020-12-05 18:48:34 +00:00
[req]
default_bits = 3072
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = root_ca
[req_distinguished_name]
countryName = Country Name (2 letter code)
countryName_default = CH
countryName_min = 2
countryName_max = 2
localityName = Locality Name (eg, city)
organizationName = Organization Name (eg, company)
organizationalUnitName = Organizational Unit Name (eg, section)
commonName = Common Name (e.g. server FQDN or YOUR name)
commonName_max = 64
[req_attributes]
[root_ca]
Setup more CAB forum compliant CA structure
2020-12-16 06:20:42 +00:00
basicConstraints = critical,CA:true
keyUsage = critical,keyCertSign,cRLSign
Improve example CA setup The example CA now has more realistic 2 levels with a root CA and a sub CA. Setup script and ca.cnf has been changed to create a root CA and a sub CA that is signed by the root CA. The sub CA is used for signing the end entity certificates. Example CA directory has been changed to example_ca for better readability.
2020-12-05 18:48:34 +00:00
subjectKeyIdentifier = hash
Setup more CAB forum compliant CA structure
2020-12-16 06:20:42 +00:00
[ext_sub_ca]
Improve example CA setup The example CA now has more realistic 2 levels with a root CA and a sub CA. Setup script and ca.cnf has been changed to create a root CA and a sub CA that is signed by the root CA. The sub CA is used for signing the end entity certificates. Example CA directory has been changed to example_ca for better readability.
2020-12-05 18:48:34 +00:00
basicConstraints = critical,CA:true,pathlen:0
Setup more CAB forum compliant CA structure
2020-12-16 06:20:42 +00:00
keyUsage = critical,keyCertSign,cRLSign
extendedKeyUsage = serverAuth,clientAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always
authorityInfoAccess = 1.3.6.1.5.5.7.48.2;URI:http://example.org/ca/root/ca.crt,OCSP;URI:http://ocsp.example.org/
crlDistributionPoints = URI:http://crl.example.org/sub.crl
certificatePolicies = @policy_sub_ca
[ext_email_ca]
basicConstraints = critical,CA:true,pathlen:0
keyUsage = critical,keyCertSign,cRLSign
extendedKeyUsage = clientAuth,emailProtection
Improve example CA setup The example CA now has more realistic 2 levels with a root CA and a sub CA. Setup script and ca.cnf has been changed to create a root CA and a sub CA that is signed by the root CA. The sub CA is used for signing the end entity certificates. Example CA directory has been changed to example_ca for better readability.
2020-12-05 18:48:34 +00:00
subjectKeyIdentifier = hash
Setup more CAB forum compliant CA structure
2020-12-16 06:20:42 +00:00
authorityKeyIdentifier = keyid:always
authorityInfoAccess = 1.3.6.1.5.5.7.48.2;URI:http://example.org/ca/root/ca.crt,OCSP;URI:http://ocsp.example.org/
crlDistributionPoints = URI:http://crl.example.org/email.crl
certificatePolicies = @policy_email_ca
[policy_sub_ca]
policyIdentifier = 1.3.6.1.5.5.7.2.1
CPS = http://example.org/ca/sub/cps.html
[policy_email_ca]
policyIdentifier = 1.3.6.1.5.5.7.2.1
CPS = http://example.org/ca/email/cps.html
Reference in a new issue Copy permalink