#
# SSLeay example configuration file.
# This is mostly being used for generation of certificate requests.
#
# Last modified by bnc on 5 May 1999.

RANDFILE		= $ENV::HOME/.rnd

####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

####################################################################
[ CA_default ]

dir              = /usr/mill/pkg/ssl/etc/ca # Where everything is kept
certs            = $dir/certs               # Where the issued certs are kept
crl_dir          = $dir/crl                 # Where the issued crl are kept
database         = $dir/index.txt           # database index file.
new_certs_dir    = $dir/newcerts            # default place for new certs.

certificate      = $dir/cacert.pem          # The CA certificate
serial           = $dir/serial              # The current serial number
crl              = $dir/crl.pem             # The current CRL
private_key      = $dir/private/cakey.pem   # The private key
RANDFILE         = $dir/private/.rand       # private random number file

x509_extensions  = x509v3_extensions        # The extentions to add to the cert
default_days     = 10000                    # how long to certify for
default_crl_days = 30                       # how long before next CRL
default_md       = md5                      # which md to use.
preserve         = no                       # keep passed DN ordering

policy           = policy_match

[ policy_match ]
commonName              = supplied
emailAddress            = supplied

####################################################################
[ req ]
default_bits            = 1024
default_keyfile         = privkey.pem
distinguished_name      = req_distinguished_name
attributes              = req_attributes

[ req_distinguished_name ]
commonName              = Username
commonName_max          = 64
emailAddress            = E-mail Address
emailAddress_max        = 40

[ req_attributes ]

[ x509v3_extensions ]
nsCaRevocationUrl       = http://www.cryptsoft.com/ca-crl.pem
nsComment               = "This is a comment"

# under ASN.1, the 0 bit would be encoded as 80
nsCertType              = 0x40