initial commit

2025-11-07 03:44:26 +00:00
commit 5d688e1ba7
8 changed files with 434 additions and 0 deletions
--- a/tls_docs/ca/root.cnf
+++ b/tls_docs/ca/root.cnf
@@ -0,0 +1,108 @@
+
+[ ca ]
+# `man ca`
+default_ca = CA_default
+
+[ CA_default ]
+# Default directory locations (make sure to properly set the dir option as it dictates the rest of the other options)
+dir               = /path/to/root_ca
+certs             = $dir/certs
+crl_dir           = $dir/crl
+new_certs_dir     = $dir/newcerts
+database          = $dir/index.txt
+serial            = $dir/serial
+RANDFILE          = $dir/private/.rand
+
+# The root key and root certificate.
+private_key       = $dir/private/root.key
+certificate       = $dir/certs/root.crt
+
+# For certificate revocation lists.
+crlnumber         = $dir/crlnumber
+crl               = $dir/crl/ca.crl
+crl_extensions    = crl_ext
+default_crl_days  = 30
+
+
+default_md        = sha256
+
+name_opt          = ca_default
+cert_opt          = ca_default
+default_days      = 375
+preserve          = no
+policy            = policy_strict
+
+[ policy_strict ]
+# policy_strict sets the root CA to sign certificates for intermediate CAs
+# POLICY FORMAT section of "man ca" has more info
+countryName             = match
+stateOrProvinceName     = match
+organizationName        = match
+organizationalUnitName  = optional
+commonName              = supplied
+emailAddress            = optional
+
+[ policy_loose ]
+# Allow the intermediate CA to sign a more diverse range of certificates
+# See the POLICY FORMAT section of the "man ca"
+countryName             = optional
+stateOrProvinceName     = optional
+localityName            = optional
+organizationName        = optional
+organizationalUnitName  = optional
+commonName              = supplied
+emailAddress            = optional
+
+[ req ]
+# `req` options. See "man req" for more info
+default_bits        = 2048
+distinguished_name  = req_distinguished_name
+string_mask         = utf8only
+
+default_md          = sha256
+
+x509_extensions     = v3_ca
+
+[ req_distinguished_name ]
+
+countryName                     = Country Name (2 letter code)
+stateOrProvinceName             = State or Province Name
+localityName                    = Locality Name
+0.organizationName              = Organization Name
+organizationalUnitName          = Organizational Unit Name
+commonName                      = Common Name
+emailAddress                    = Email Address
+
+# Defaults
+countryName_default             = US
+stateOrProvinceName_default     = State/Province
+localityName_default            = City
+0.organizationName_default      = Your Org
+organizationalUnitName_default  = Your OU
+emailAddress_default            =
+
+[ v3_ca ]
+# Normal CA extensions. "man x509v3_config" has more info.
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer
+basicConstraints = critical, CA:true
+keyUsage = critical, digitalSignature, cRLSign, keyCertSign
+
+[ v3_intermediate_ca ]
+# Extensions for a typical intermediate CA "man x509v3_config"
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer
+basicConstraints = critical, CA:true, pathlen:0
+keyUsage = critical, digitalSignature, cRLSign, keyCertSign
+
+[ crl_ext ]
+# CRL extensions if needed. See "man x509v3_config" for more info
+authorityKeyIdentifier=keyid:always
+
+[ ocsp ]
+# If OCSP is needed. See "man ocsp" for more info.
+basicConstraints = CA:FALSE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer
+keyUsage = critical, digitalSignature
+extendedKeyUsage = critical, OCSPSigning