summaryrefslogtreecommitdiff
path: root/src/etc/ipsec.d/key-pair.template
blob: 56be97516bf9ec00439414280b9f49481ffeb6de (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
[ req ]
 default_bits           = 2048
 default_keyfile        = privkey.pem
 distinguished_name     = req_distinguished_name
 string_mask            = utf8only
 attributes             = req_attributes
 dirstring_type         = nobmp
# SHA-1 is deprecated, so use SHA-2 instead.
 default_md             = sha256
# Extension to add when the -x509 option is used.
 x509_extensions        = v3_ca

[ req_distinguished_name ]
 countryName                    = Country Name (2 letter code)
 countryName_min                = 2
 countryName_max                = 2
 ST             = State Name 
 localityName                   = Locality Name (eg, city)
 organizationName               = Organization Name (eg, company)
 organizationalUnitName         = Organizational Unit Name (eg, department)
 commonName                     = Common Name (eg, Device hostname)
 commonName_max                 = 64
 emailAddress                   = Email Address
 emailAddress_max               = 40
[ req_attributes ]
 challengePassword              = A challenge password (optional)
 challengePassword_min          = 4
 challengePassword_max          = 20
[ v3_ca ]
 subjectKeyIdentifier=hash
 authorityKeyIdentifier=keyid:always,issuer:always
 basicConstraints = critical, CA:true
 keyUsage = critical, digitalSignature, cRLSign, keyCertSign
[ v3_intermediate_ca ]
# Extensions for a typical intermediate CA (`man x509v3_config`).
 subjectKeyIdentifier = hash
 authorityKeyIdentifier = keyid:always,issuer
 basicConstraints = critical, CA:true, pathlen:0
 keyUsage = critical, digitalSignature, cRLSign, keyCertSign
[ usr_cert ]
# Extensions for client certificates (`man x509v3_config`).
 basicConstraints = CA:FALSE
 nsCertType = client, email
 nsComment = "OpenSSL Generated Client Certificate"
 subjectKeyIdentifier = hash
 authorityKeyIdentifier = keyid,issuer
 keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
 extendedKeyUsage = clientAuth, emailProtection
[ server_cert ]
# Extensions for server certificates (`man x509v3_config`).
 basicConstraints = CA:FALSE
 nsCertType = server
 nsComment = "OpenSSL Generated Server Certificate"
 subjectKeyIdentifier = hash
 authorityKeyIdentifier = keyid,issuer:always
 keyUsage = critical, digitalSignature, keyEncipherment
 extendedKeyUsage = serverAuth
[ crl_ext ]
# Extension for CRLs (`man x509v3_config`).
 authorityKeyIdentifier=keyid:always
[ ocsp ]
# Extension for OCSP signing certificates (`man ocsp`).
 basicConstraints = CA:FALSE
 subjectKeyIdentifier = hash
 authorityKeyIdentifier = keyid,issuer
 keyUsage = critical, digitalSignature
 extendedKeyUsage = critical, OCSPSigning