1 # X.509 Certificate options
5 # The organization of the subject.
8 # The organizational unit of the subject.
11 # The locality of the subject.
14 # The state of the certificate owner.
17 # The country of the subject. Two letter code.
20 # The common name of the certificate owner.
23 # A user id of the certificate owner.
26 # Set domain components
30 # If the supported DN OIDs are not adequate you can set
32 # For example set the X.520 Title and the X.520 Pseudonym
33 # by using OID and string pairs.
34 #dn_oid = "2.5.4.12 Dr."
35 #dn_oid = "2.5.4.65 jackal"
37 # This is deprecated and should not be used in new
39 # pkcs9_email = "none@none.org"
41 # An alternative way to set the certificate's distinguished name directly
42 # is with the "dn" option. The attribute names allowed are:
43 # C (country), street, O (organization), OU (unit), title, CN (common name),
44 # L (locality), ST (state), placeOfBirth, gender, countryOfCitizenship,
45 # countryOfResidence, serialNumber, telephoneNumber, surName, initials,
46 # generationQualifier, givenName, pseudonym, dnQualifier, postalCode, name,
47 # businessCategory, DC, UID, jurisdictionOfIncorporationLocalityName,
48 # jurisdictionOfIncorporationStateOrProvinceName,
49 # jurisdictionOfIncorporationCountryName, XmppAddr, and numeric OIDs.
51 #dn = "cn = Nikos,st = New\, Something,C=GR,surName=Mavrogiannopoulos,2.5.4.9=Arkadias"
53 # The serial number of the certificate
54 # The value is in decimal (i.e. 1963) or hex (i.e. 0x07ab).
55 # Comment the field for a random serial number.
58 # In how many days, counting from today, this certificate will expire.
59 # Use -1 if there is no expiration date.
60 expiration_days = 3650
62 # Alternatively you may set concrete dates and time. The GNU date string
63 # formats are accepted. See:
64 # https://www.gnu.org/software/tar/manual/html_node/Date-input-formats.html
66 #activation_date = "2004-02-29 16:21:42"
67 #expiration_date = "2025-02-29 16:24:41"
71 # A dnsname in case of a WWW server.
72 #dns_name = "www.none.org"
73 #dns_name = "www.morethanone.org"
75 # An othername defined by an OID and a hex encoded string
76 #other_name = "1.3.6.1.5.2.2 302ca00d1b0b56414e5245494e2e4f5247a11b3019a006020400000002a10f300d1b047269636b1b0561646d696e"
77 #other_name_utf8 = "1.2.4.5.6 A UTF8 string"
78 #other_name_octet = "1.2.4.5.6 A string that will be encoded as ASN.1 octet string"
80 # Allows writing an XmppAddr Identifier
81 #xmpp_name = juliet@im.example.com
83 # Names used in PKINIT
84 #krb5_principal = user@REALM.COM
85 #krb5_principal = HTTP/user@REALM.COM
87 # A subject alternative name URI
88 #uri = "https://www.example.com"
90 # An IP address in case of a server.
91 #ip_address = "192.168.1.1"
93 # An email in case of a person
94 email = "bounce@gnunet.org"
96 # TLS feature (rfc7633) extension. That can is used to indicate mandatory TLS
97 # extension features to be provided by the server. In practice this is used
98 # to require the Status Request (extid: 5) extension from the server. That is,
99 # to require the server holding this certificate to provide a stapled OCSP response.
100 # You can have multiple lines for multiple TLS features.
102 # To ask for OCSP status request use:
105 # Challenge password used in certificate requests
106 challenge_password = 123456
108 # Password when encrypting a private key
111 # An URL that has CRLs (certificate revocation lists)
112 # available. Needed in CA certificates.
113 #crl_dist_points = "https://www.getcrl.crl/getcrl/"
115 # Whether this is a CA certificate or not
118 # Subject Unique ID (in hex)
119 #subject_unique_id = 00153224
121 # Issuer Unique ID (in hex)
122 #issuer_unique_id = 00153225
126 # The following key usage flags are used by CAs and end certificates
128 # Whether this certificate will be used to sign data (needed
129 # in TLS DHE ciphersuites). This is the digitalSignature flag
130 # in RFC5280 terminology.
133 # Whether this certificate will be used to encrypt data (needed
134 # in TLS RSA ciphersuites). Note that it is preferred to use different
135 # keys for encryption and signing. This is the keyEncipherment flag
136 # in RFC5280 terminology.
139 # Whether this key will be used to sign other certificates. The
140 # keyCertSign flag in RFC5280 terminology.
143 # Whether this key will be used to sign CRLs. The
144 # cRLSign flag in RFC5280 terminology.
147 # The keyAgreement flag of RFC5280. It's purpose is loosely
148 # defined. Not use it unless required by a protocol.
151 # The dataEncipherment flag of RFC5280. It's purpose is loosely
152 # defined. Not use it unless required by a protocol.
155 # The nonRepudiation flag of RFC5280. It's purpose is loosely
156 # defined. Not use it unless required by a protocol.
159 #### Extended key usage (key purposes)
161 # The following extensions are used in an end certificate
162 # to clarify its purpose. Some CAs also use it to indicate
163 # the types of certificates they are purposed to sign.
166 # Whether this certificate will be used for a TLS client;
167 # this sets the id-kp-clientAuth (1.3.6.1.5.5.7.3.2) of
168 # extended key usage.
171 # Whether this certificate will be used for a TLS server;
172 # this sets the id-kp-serverAuth (1.3.6.1.5.5.7.3.1) of
173 # extended key usage.
176 # Whether this key will be used to sign code. This sets the
177 # id-kp-codeSigning (1.3.6.1.5.5.7.3.3) of extended key usage
181 # Whether this key will be used to sign OCSP data. This sets the
182 # id-kp-OCSPSigning (1.3.6.1.5.5.7.3.9) of extended key usage extension.
185 # Whether this key will be used for time stamping. This sets the
186 # id-kp-timeStamping (1.3.6.1.5.5.7.3.8) of extended key usage extension.
189 # Whether this key will be used for email protection. This sets the
190 # id-kp-emailProtection (1.3.6.1.5.5.7.3.4) of extended key usage extension.
191 #email_protection_key
193 # Whether this key will be used for IPsec IKE operations (1.3.6.1.5.5.7.3.17).
196 ## adding custom key purpose OIDs
198 # for microsoft smart card logon
199 # key_purpose_oid = 1.3.6.1.4.1.311.20.2.2
201 # for email protection
202 # key_purpose_oid = 1.3.6.1.5.5.7.3.4
204 # for any purpose (must not be used in intermediate CA certificates)
205 # key_purpose_oid = 2.5.29.37.0
207 ### end of key purpose OIDs
209 ### Adding arbitrary extensions
210 # This requires to provide the extension OIDs, as well as the extension data in
211 # hex format. The following two options are available since GnuTLS 3.5.3.
212 #add_extension = "1.2.3.4 0x0AAB01ACFE"
214 # As above but encode the data as an octet string
215 #add_extension = "1.2.3.4 octet_string(0x0AAB01ACFE)"
217 # For portability critical extensions shouldn't be set to certificates.
218 #add_critical_extension = "5.6.7.8 0x1AAB01ACFE"
220 # When generating a certificate from a certificate
221 # request, then honor the extensions stored in the request
222 # and store them in the real certificate.
223 #honor_crq_extensions
225 # Alternatively only specific extensions can be copied.
226 #honor_crq_ext = 2.5.29.17
227 #honor_crq_ext = 2.5.29.15
229 # Path length contraint. Sets the maximum number of
230 # certificates that can be used to certify this certificate.
231 # (i.e. the certificate chain length)
236 # ocsp_uri = https://my.ocsp.server/ocsp
239 # ca_issuers_uri = https://my.ca.issuer
241 # Certificate policies
242 #policy1 = 1.3.6.1.4.1.5484.1.10.99.1.0
243 #policy1_txt = "This is a long policy to summarize"
244 #policy1_url = https://www.example.com/a-policy-to-read
246 #policy2 = 1.3.6.1.4.1.5484.1.10.99.1.1
247 #policy2_txt = "This is a short policy"
248 #policy2_url = https://www.example.com/another-policy-to-read
250 # The number of additional certificates that may appear in a
251 # path before the anyPolicy is no longer acceptable.
252 #inhibit_anypolicy_skip_certs 1
257 #nc_permit_dns = example.com
258 #nc_exclude_dns = test.example.com
261 #nc_permit_email = "nmav@ex.net"
263 # Exclude subdomains of example.com
264 #nc_exclude_email = .example.com
266 # Exclude all e-mail addresses of example.com
267 #nc_exclude_email = example.com
270 #nc_permit_ip = 192.168.0.0/16
271 #nc_exclude_ip = 192.168.5.0/24
272 #nc_permit_ip = fc0a:eef2:e7e7:a56e::/64
275 # Options for proxy certificates
276 #proxy_policy_language = 1.3.6.1.5.5.7.21.1
279 # Options for generating a CRL
281 # The number of days the next CRL update will be due.
282 # next CRL update will be in 43 days
283 #crl_next_update = 43
285 # this is the 5th CRL by this CA
286 # The value is in decimal (i.e. 1963) or hex (i.e. 0x07ab).
287 # Comment the field for a time-based number.
288 # Time-based CRL numbers generated in GnuTLS 3.6.3 and later
289 # are significantly larger than those generated in previous
290 # versions. Since CRL numbers need to be monotonic, you need
291 # to specify the CRL number here manually if you intend to
292 # downgrade to an earlier version than 3.6.3 after publishing
293 # the CRL as it is not possible to specify CRL numbers greater
294 # than 2**63-2 using hex notation in those versions.
297 # Specify the update dates more precisely.
298 #crl_this_update_date = "2004-02-29 16:21:42"
299 #crl_next_update_date = "2025-02-29 16:24:41"
301 # The date that the certificates will be made seen as
303 #crl_revocation_date = "2025-02-29 16:24:41"