#

# Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.

# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

#

# This code is free software; you can redistribute it and/or modify it

# under the terms of the GNU General Public License version 2 only, as

# published by the Free Software Foundation. Oracle designates this

# particular file as subject to the "Classpath" exception as provided

# by Oracle in the LICENSE file that accompanied this code.

#

# This code is distributed in the hope that it will be useful, but WITHOUT

# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License

# version 2 for more details (a copy is included in the LICENSE file that

# accompanied this code).

#

# You should have received a copy of the GNU General Public License version

# 2 along with this work; if not, write to the Free Software Foundation,

# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

#

# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

# or visit www.oracle.com if you need additional information or have any

# questions.

#

#

# OpenSSL configuration file.

#

HOME = .

RANDFILE = $ENV::HOME/.rnd

[ ca ]

default_ca = CA_default

[ CA_default ]

dir = ./top

certs = $dir/certs

crl_dir = $dir/crl

database = $dir/index.txt

unique_subject = no

new_certs_dir = $dir/newcerts

certificate = $dir/cacert.pem

serial = $dir/serial

crlnumber = $dir/crlnumber

crl = $dir/crl.pem

private_key = $dir/private/cakey.pem

RANDFILE = $dir/private/.rand

x509_extensions = v3_ca

name_opt = ca_default

cert_opt = ca_default

default_days = 7650

default_crl_days = 30

default_md = sha1

preserve = no

policy = policy_anything

[ ca_top ]

dir = ./root

certs = $dir/certs

crl_dir = $dir/crl

database = $dir/index.txt

unique_subject = no

new_certs_dir = $dir/newcerts

certificate = $dir/cacert.pem

serial = $dir/serial

crlnumber = $dir/crlnumber

crl = $dir/crl.pem

private_key = $dir/private/cakey.pem

RANDFILE = $dir/private/.rand

x509_extensions = v3_ca

name_opt = ca_default

cert_opt = ca_default

default_days = 7650

default_crl_days = 30

default_md = sha1

preserve = no

policy = policy_anything

[ ca_subca ]

dir = ./subca

certs = $dir/certs

crl_dir = $dir/crl

database = $dir/index.txt

unique_subject = no

new_certs_dir = $dir/newcerts

certificate = $dir/cacert.pem

serial = $dir/serial

crlnumber = $dir/crlnumber

crl = $dir/crl.pem

private_key = $dir/private/cakey.pem

RANDFILE = $dir/private/.rand

x509_extensions = usr_cert

name_opt = ca_default

cert_opt = ca_default

default_days = 7650

default_crl_days = 30

default_md = sha1

preserve = no

policy = policy_anything

[ policy_match ]

countryName = match

stateOrProvinceName = match

organizationName = match

organizationalUnitName = optional

commonName = supplied

emailAddress = optional

[ policy_anything ]

countryName = optional

stateOrProvinceName = optional

localityName = optional

organizationName = optional

organizationalUnitName = optional

commonName = supplied

emailAddress = optional

[ req ]

default_bits = 1024

default_keyfile = privkey.pem

distinguished_name = req_distinguished_name

attributes = req_attributes

x509_extensions = v3_ca

string_mask = nombstr

[ req_distinguished_name ]

countryName = Country Name (2 letter code)

countryName_default = NO

countryName_min = 2

countryName_max = 2

stateOrProvinceName = State or Province Name (full name)

stateOrProvinceName_default = A-State

localityName = Locality Name (eg, city)

0.organizationName = Organization Name (eg, company)

0.organizationName_default = Internet Widgits Pty Ltd

organizationalUnitName = Organizational Unit Name (eg, section)

commonName = Common Name (eg, YOUR name)

commonName_max = 64

emailAddress = Email Address

emailAddress_max = 64

[ req_attributes ]

challengePassword = A challenge password

challengePassword_min = 4

challengePassword_max = 20

unstructuredName = An optional company name

[ usr_cert ]

keyUsage = nonRepudiation, digitalSignature, keyEncipherment

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid,issuer

[ v3_req ]

basicConstraints = CA:FALSE

keyUsage = nonRepudiation, digitalSignature, keyEncipherment

subjectAltName = email:example@openjdk.net, RID:1.2.3.4:true

[ v3_ca ]

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid:always,issuer:always

basicConstraints = critical,CA:true

keyUsage = keyCertSign

[ cert_issuer ]

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid:always,issuer:always

basicConstraints = critical,CA:true

keyUsage = keyCertSign

nameConstraints = excluded;RID:1.2.3.4.5

[ crl_issuer ]

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid:always,issuer:always

keyUsage = cRLSign

[ crl_ext ]

authorityKeyIdentifier = keyid:always,issuer:always

[ ee_of_subca ]

keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid,issuer

[ alice_of_subca ]

keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement

subjectAltName = RID:1.2.3.4

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid,issuer

[ susan_of_subca ]

keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement

subjectAltName = RID:1.2.3.4.5

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid,issuer