etc/openssl/sympa.heureux-cyclage.org/host.cfg

   1         SERVICE     = sympa
   2         RANDFILE    = var/sec/x509/openssl.rand
   3         oid_section = extra_oids
   4 [ extra_oids ]
   5         # NOTE: pour une éventuelle validation étendue (Extended Validation (EV))
   6         jurisdictionOfIncorporationLocalityName        = 1.3.6.1.4.1.311.60.2.1.1
   7         jurisdictionOfIncorporationStateOrProvinceName = 1.3.6.1.4.1.311.60.2.1.2
   8         jurisdictionOfIncorporationCountryName         = 1.3.6.1.4.1.311.60.2.1.3
   9 [ req ]
  10         prompt             = no
  11         distinguished_name = distinguished_name
  12         string_mask        = pkix
  13         #x509_extensions    = root_extensions
  14         #req_extensions     = extension
  15         #attributes         = req_attributes
  16 [ distinguished_name ]
  17         countryName            = $ENV::x509_country
  18         stateOrProvinceName    = $ENV::x509_state_or_province
  19         localityName           = $ENV::x509_state_or_province
  20         0.organizationName     = $ENV::x509_organization
  21         organizationalUnitName = SYsteme de Multi-Postage Automatique
  22         commonName             = $SERVICE.$ENV::x509_host
  23         businessCategory                               = $ENV::x509_business_category
  24         jurisdictionOfIncorporationLocalityName        = $ENV::x509_state_or_province
  25         jurisdictionOfIncorporationStateOrProvinceName = $ENV::x509_state_or_province
  26         jurisdictionOfIncorporationCountryName         = $ENV::x509_country
  27 [ extensions ]
  28         basicConstraints       = critical,CA:TRUE,pathlen:0
  29         keyUsage               = keyCertSign,cRLSign,digitalSignature,keyEncipherment
  30         subjectAltName         = email:contact+$SERVICE@$ENV::x509_host,DNS:$SERVICE.$ENV::x509_host,DNS:$SERVICE.cyclocoop.org,DNS:$SERVICE.cyclocoop.heureux-cyclage.org,DNS:$SERVICE.ptitvelo.net,DNS:$SERVICE.ptitvelo.heureux-cyclage.org
  31
  32         subjectKeyIdentifier   = hash
  33         issuerAltName          = issuer:copy
  34         authorityKeyIdentifier = keyid:always,issuer:always
  35         authorityInfoAccess    = caIssuers;URI:http://www.$ENV::x509_host/x509/crt.pem
  36         crlDistributionPoints  = URI:http://www.$ENV::x509_host/x509/$SERVICE/crl.pem
  37         certificatePolicies    = @certificate_policies
  38 [ self_signed_extensions ]
  39         basicConstraints       = critical,CA:TRUE,pathlen:0
  40         keyUsage               = keyCertSign,cRLSign,digitalSignature,keyEncipherment
  41         subjectAltName         = email:contact+$SERVICE@$ENV::x509_host,DNS:$SERVICE.$ENV::x509_host,DNS:$SERVICE.cyclocoop.org,DNS:$SERVICE.cyclocoop.heureux-cyclage.org,DNS:$SERVICE.ptitvelo.net,DNS:$SERVICE.ptitvelo.heureux-cyclage.org
  42         subjectKeyIdentifier   = hash
  43         issuerAltName          = issuer:copy
  44         authorityKeyIdentifier = keyid:always,issuer:always
  45         authorityInfoAccess    = caIssuers;URI:http://www.$ENV::x509_host/x509/$SERVICE/crt.pem
  46         crlDistributionPoints  = URI:http://www.$ENV::x509_host/x509/$SERVICE/crl.pem
  47 [ user_extensions ]
  48         basicConstraints       = critical,CA:FALSE,pathlen:0
  49         keyUsage               = digitalSignature,keyEncipherment
  50         subjectAltName         = email:$ENV::user@$ENV::x509_host
  51         subjectKeyIdentifier   = hash
  52         issuerAltName          = issuer:copy
  53         authorityKeyIdentifier = keyid:always,issuer:always
  54         authorityInfoAccess    = caIssuers;URI:http://www.$ENV::x509_host/x509/$SERVICE/crt.pem
  55 [ certificate_policies ]
  56         policyIdentifier = 1.2.250.1.42
  57         CPS.1            = https://www.$ENV::x509_host/x509/cps
  58 [ ca ]
  59         private_key      = var/sec/x509/$ENV::x509/key.pem
  60         dir              = var/pub/x509/$ENV::x509
  61         crl_dir          = $dir
  62         crlnumber        = $dir/crl.num
  63         crl              = $dir/crl.pem
  64         database         = $dir/idx.txt
  65 [ self_signed_ca ]
  66         private_key      = var/sec/x509/$ENV::x509/key.pem
  67         dir              = var/pub/x509/$ENV::x509
  68         crl_dir          = $dir
  69         crlnumber        = $dir/crl.self-signed.num
  70         crl              = $dir/crl.self-signed.pem
  71         database         = $dir/idx.self-signed.txt