mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-12-21 06:09:35 +08:00
Code Issues Packages Projects Releases Wiki Activity
cb5c208bf2
openssl/test/smime-certs/ca.cnf

77 lines
2.1 KiB
Plaintext
Raw Normal View History

Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
#
# OpenSSL example configuration file for automated certificate creation.
#
Add config_diagnostics to our configuration files. The change to a more configuration based approach to enable FIPS mode operation highlights a shortcoming in the default should do something approach we've taken for bad configuration files. Currently, a bad configuration file will be automatically loaded and once the badness is detected, it will silently stop processing the configuration and continue normal operations. This is good for remote servers, allowing changes to be made without bricking things. It's bad when a user thinks they've configured what they want but got something wrong and it still appears to work. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16171)
2021-07-29 07:55:09 +08:00
# Comment out the next line to ignore configuration errors
config_diagnostics = 1
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
# This definition stops the following lines choking if HOME or CN
# is undefined.
HOME = .
CN = "Not Defined"
default_ca = ca
####################################################################
test/smime-certs/{mksmime-certs.sh,ca.cnf}: simplify and speed up cert generation Also remove inconsistent key usages from non-RSA certs. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19076)
2022-08-26 00:09:09 +08:00
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
[ req ]
default_bits = 2048
default_keyfile = privkey.pem
# Don't prompt for fields: use those in section directly
prompt = no
distinguished_name = req_distinguished_name
test/smime-certs/ca.cnf: clean up comments, simplify settings using SKID and AKID defaults Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19064)
2022-08-25 23:45:40 +08:00
x509_extensions = v3_ca # The extensions to add to the self signed cert
string_mask = utf8only
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
# req_extensions = v3_req # The extensions to add to a certificate request
[ req_distinguished_name ]
countryName = UK
organizationName = OpenSSL Group
# Take CN from environment so it can come from a script.
commonName = $ENV::CN
test/smime-certs/{mksmime-certs.sh,ca.cnf}: simplify and speed up cert generation Also remove inconsistent key usages from non-RSA certs. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19076)
2022-08-26 00:09:09 +08:00
[ usr_rsa_cert ]
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
test/smime-certs/ca.cnf: clean up comments, simplify settings using SKID and AKID defaults Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19064)
2022-08-25 23:45:40 +08:00
# These extensions are added when 'ca' signs a request for a normal end-entity
# certificate with key usage restrictions compatible with RSA keys
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
test/smime-certs/ca.cnf: clean up comments, simplify settings using SKID and AKID defaults Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19064)
2022-08-25 23:45:40 +08:00
basicConstraints = CA:FALSE
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
test/smime-certs/ca.cnf: clean up comments, simplify settings using SKID and AKID defaults Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19064)
2022-08-25 23:45:40 +08:00
# Following SKID and AKID settings are meanwhile by default in all certificates.
# See doc/man5/x509v3_config.pod for details.
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
test/smime-certs/ca.cnf: clean up comments, simplify settings using SKID and AKID defaults Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19064)
2022-08-25 23:45:40 +08:00
# subjectKeyIdentifier = hash
# authorityKeyIdentifier = keyid, issuer
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
test/smime-certs/{mksmime-certs.sh,ca.cnf}: simplify and speed up cert generation Also remove inconsistent key usages from non-RSA certs. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19076)
2022-08-26 00:09:09 +08:00
[ signer_cert ]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature
test/smime-certs/ca.cnf: clean up comments, simplify settings using SKID and AKID defaults Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19064)
2022-08-25 23:45:40 +08:00
[ dh_cert ]
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
test/smime-certs/ca.cnf: clean up comments, simplify settings using SKID and AKID defaults Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19064)
2022-08-25 23:45:40 +08:00
# These extensions are added when 'ca' signs a request for an end-entity
# DH certificate, for which only key agreement makes sense
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
test/smime-certs/ca.cnf: clean up comments, simplify settings using SKID and AKID defaults Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19064)
2022-08-25 23:45:40 +08:00
basicConstraints = CA:FALSE
keyUsage = critical, keyAgreement
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
cms: Create test for for purpose verification in cms application The tests only cover the correct handling of the codesigning purpose in the certificates in the context of the cms command line tool. The interpretation of the certificate purpose is tested in the context of the "verify" app. The correct handling of the cms objects is tested by other tests in 80-test_cms.t. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18567)
2022-06-16 01:01:43 +08:00
[ codesign_cert ]
# These extensions are added when 'ca' signs a request for a code-signing
test/smime-certs/ca.cnf: clean up comments, simplify settings using SKID and AKID defaults Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19064)
2022-08-25 23:45:40 +08:00
# end-entity certificate compatible with RSA and ECC keys
cms: Create test for for purpose verification in cms application The tests only cover the correct handling of the codesigning purpose in the certificates in the context of the cms command line tool. The interpretation of the certificate purpose is tested in the context of the "verify" app. The correct handling of the cms objects is tested by other tests in 80-test_cms.t. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18567)
2022-06-16 01:01:43 +08:00
test/smime-certs/ca.cnf: clean up comments, simplify settings using SKID and AKID defaults Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19064)
2022-08-25 23:45:40 +08:00
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature
extendedKeyUsage = codeSigning
cms: Create test for for purpose verification in cms application The tests only cover the correct handling of the codesigning purpose in the certificates in the context of the cms command line tool. The interpretation of the certificate purpose is tested in the context of the "verify" app. The correct handling of the cms objects is tested by other tests in 80-test_cms.t. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18567)
2022-06-16 01:01:43 +08:00
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
[ v3_ca ]
test/smime-certs/ca.cnf: clean up comments, simplify settings using SKID and AKID defaults Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19064)
2022-08-25 23:45:40 +08:00
# Extensions for a typical CA as required by RFC 5280 etc.
# SKID and AKID are by default set according to PKIX recommendation.
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
test/smime-certs/ca.cnf: clean up comments, simplify settings using SKID and AKID defaults Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19064)
2022-08-25 23:45:40 +08:00
basicConstraints = critical, CA:true
Scripts to recreate S/MIME test certificates. Add a script to generate keys and certificates for the S/MIME and CMS tests. Update certificates and add EC examples.
2013-07-17 23:30:04 +08:00
keyUsage = critical, cRLSign, keyCertSign
Reference in New Issue Copy Permalink