mirror of https://github.com/dexidp/dex.git
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
82 lines
2.4 KiB
82 lines
2.4 KiB
# OpenSSL configuration file. |
|
# Adapted from https://github.com/coreos/matchbox/blob/master/examples/etc/matchbox/openssl.conf |
|
|
|
# default environment variable values |
|
SAN = |
|
|
|
[ ca ] |
|
# `man ca` |
|
default_ca = CA_default |
|
|
|
[ CA_default ] |
|
# Directory and file locations. |
|
dir = . |
|
certs = $dir/certs |
|
crl_dir = $dir/crl |
|
new_certs_dir = $dir/newcerts |
|
database = $dir/index.txt |
|
serial = $dir/serial |
|
# certificate revocation lists. |
|
crlnumber = $dir/crlnumber |
|
crl = $dir/crl/intermediate-ca.crl |
|
crl_extensions = crl_ext |
|
default_crl_days = 30 |
|
default_md = sha256 |
|
|
|
name_opt = ca_default |
|
cert_opt = ca_default |
|
default_days = 375 |
|
preserve = no |
|
policy = policy_loose |
|
|
|
[ policy_loose ] |
|
# Allow the CA to sign a range of certificates. |
|
countryName = optional |
|
stateOrProvinceName = optional |
|
localityName = optional |
|
organizationName = optional |
|
organizationalUnitName = optional |
|
commonName = supplied |
|
emailAddress = optional |
|
|
|
[ req ] |
|
# `man req` |
|
default_bits = 4096 |
|
distinguished_name = req_distinguished_name |
|
string_mask = utf8only |
|
default_md = sha256 |
|
|
|
[ req_distinguished_name ] |
|
countryName = Country Name (2 letter code) |
|
stateOrProvinceName = State or Province Name |
|
localityName = Locality Name |
|
0.organizationName = Organization Name |
|
organizationalUnitName = Organizational Unit Name |
|
commonName = Common Name |
|
|
|
# Certificate extensions (`man x509v3_config`) |
|
|
|
[ v3_ca ] |
|
subjectKeyIdentifier = hash |
|
authorityKeyIdentifier = keyid:always,issuer |
|
basicConstraints = critical, CA:true, pathlen:0 |
|
keyUsage = critical, digitalSignature, cRLSign, keyCertSign |
|
|
|
[ usr_cert ] |
|
basicConstraints = CA:FALSE |
|
nsCertType = client |
|
nsComment = "OpenSSL Generated Client Certificate" |
|
subjectKeyIdentifier = hash |
|
authorityKeyIdentifier = keyid,issuer |
|
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment |
|
extendedKeyUsage = clientAuth |
|
|
|
[ server_cert ] |
|
basicConstraints = CA:FALSE |
|
nsCertType = server |
|
nsComment = "OpenSSL Generated Server Certificate" |
|
subjectKeyIdentifier = hash |
|
authorityKeyIdentifier = keyid,issuer:always |
|
keyUsage = critical, digitalSignature, keyEncipherment |
|
extendedKeyUsage = serverAuth |
|
subjectAltName = $ENV::SAN
|
|
|