openssl.cnf

# Commands to create a surrogate TLS server certificate chain of trust

##################
# CA
##################

# CA encrypted key
# EC
# openssl genpkey -out private/ca.key.pem \
#     -algorithm EC -pkeyopt ec_paramgen_curve:${EC_PARAMGEN_CURVE} -aes256 \
#     -pass file:private/passphrase.txt

# RSA
# # openssl genpkey -out private/ca.key.pem  \
# #     -algorithm RSA -pkeyopt rsa_keygen_bits:${RSA_KEYGEN_BITS} -aes256 \
# #     -pass file:private/passphrase.txt

# CA certificate
# openssl req -config openssl.cnf \
#     -new -x509 -days 1460 -${HASH_DIGEST} -extensions v3_ca -out ca.cert.pem \
#     -key private/ca.key.pem -passin file:private/passphrase.txt -batch

# CA certificate text verification
# openssl x509 -text -noout -in ca.cert.pem

# CA certificate openssl self-verification
# openssl verify -CAfile ca.cert.pem ca.cert.pem

##################
# Intermediate CA
##################

# Intermediate CA encrypted key
# EC
# openssl genpkey -out intermediate/private/intermediate.key.pem \
#     -algorithm EC -pkeyopt ec_paramgen_curve:${EC_PARAMGEN_CURVE} -aes256 \
#     -passout file:intermediate/private/passphrase_intermediate.txt

# RSA
# openssl genpkey -out intermediate/private/intermediate.key.pem \
#     -algorithm RSA -pkeyopt rsa_keygen_bits:${RSA_KEYGEN_BITS} -aes256 \
#     -pass file:intermediate/private/passphrase_intermediate.txt

# Intermediate CA CSR
# openssl req -config intermediate/openssl_intermediate.cnf -new -${HASH_DIGEST} \
#     -key intermediate/private/intermediate.key.pem \
#     -passin file:intermediate/private/passphrase_intermediate.txt -batch \
#     -out intermediate/intermediate.csr.pem

# CA initialize database
# sh -c 'echo 01 > serial'
# touch index.txt

# Intermediate CA certificate
# openssl ca -config openssl.cnf \
#     -days 730 -notext -md ${HASH_DIGEST} -extensions v3_intermediate_ca \
#     -in intermediate/intermediate.csr.pem \
#     -out intermediate/intermediate.cert.pem
#     -passin file:private/passphrase.txt -batch

# Intermediate CA chain
# sh -c 'cat intermediate/intermediate.cert.pem ca.cert.pem \
#     > intermediate/ca-chain.cert.pem'

# Intermediate CA certificate text verification
# openssl x509 -text -noout -in intermediate/intermediate.cert.pem

# Intermediate CA chain openssl self-verification
# openssl verify -CAfile ca.cert.pem intermediate/ca-chain.cert.pem

##################
# Client Certs
##################

# Client certificate encrypted key
# openssl genrsa -aes256 -out intermediate/private/www.example.com.key.pem \
#     -passout file:intermediate/private/passphrase_client.txt 4096

# Client certificate decrypted key
# openssl rsa -in intermediate/private/www.example.com.key.pem \
#     -passin file:intermediate/private/passphrase_client.txt \
#     -out intermediate/private/www.example.com.key.pem.decrypted

# Client certificate CSR
# openssl req -config intermediate/openssl_intermediate.cnf -new -${HASH_DIGEST} \
#     -key intermediate/private/www.example.com.key.pem \
#     -passin file:intermediate/private/passphrase_client.txt -batch \
#     -out intermediate/www.example.com.csr.pem

# Intermediate CA initialize database
# sh -c 'echo 01 > intermediate/serial'
# touch intermediate/index.txt

# Client certificate
# openssl ca -config intermediate/openssl_intermediate.cnf \
#     -days 375 -notext -md ${HASH_DIGEST} \
#     -in intermediate/www.example.com.csr.pem \
#     -out intermediate/www.example.com.cert.pem
#     -passin file:intermediate/private/passphrase_intermediate.txt -batch \
#     -subj '/CN=www.example.com'

# Client certificate text verification
# openssl x509 -text -noout -in intermediate/www.example.com.cert.pem

# Client chain openssl self-verification
# openssl verify -CAfile intermediate/ca-chain.cert.pem \
#     intermediate/www.example.com.cert.pem

# Client chain of trust
# sh -c 'cat intermediate/www.example.com.cert.pem \
#     intermediate/intermediate.cert.pem ca.cert.pem \
#     > intermediate/www.example.com.chain.pem'

# Client certificate SHA1 hash
# openssl x509 -noout -fingerprint -sha1 -inform pem \
# -in intermediate/www.example.com.cert.pem \
# | tr -d ':' | sed -e 's|^SHA1 Fingerprint=||'

# Client certificate of the forms
# @host@.@domain@.@tld@.@CERTIFICATE_SHA1@.{cert,key,chain}.pem


[ca]
default_ca        = CA_default

[ CA_default ]
# Directory and file locations.
dir               = ca
certs             = $dir/certs
crl_dir           = $dir/crl
new_certs_dir     = $dir/newcerts
database          = $dir/index.txt
serial            = $dir/serial
RANDFILE          = $dir/private/.rand

# The root key and root certificate.
private_key       = $dir/private/ca.key.pem
certificate       = $dir/certs/ca.cert.pem

# For certificate revocation lists.
crlnumber         = $dir/crlnumber
crl               = $dir/crl/ca.crl.pem
crl_extensions    = crl_ext
default_crl_days  = 30

# SHA-1 is deprecated, so use SHA-2 instead.
default_md        = sha256

name_opt          = ca_default
cert_opt          = ca_default
# 12 years (plus leap days)
default_days      = 4383
preserve          = no
policy            = policy_strict

# allow issuing multiple certificates with the same CN 
unique_subject = no

[ policy_strict ]
# The root CA should only sign intermediate certificates that match.
# See the POLICY FORMAT section of `man ca`.
countryName             = match
stateOrProvinceName     = match
localityName            = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ policy_loose ]
# Allow the intermediate CA to sign a more diverse range of certificates.
# See the POLICY FORMAT section of the `ca` man page.
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = optional
emailAddress            = optional

[ req ]
# Options for the `req` tool (`man req`).
default_bits        = 4096
distinguished_name  = req_distinguished_name
string_mask         = utf8only

# SHA-1 is deprecated, so use SHA-2 instead.
default_md          = sha256

# Extension to add when the -x509 option is used.
x509_extensions     = v3_ca

[ req_distinguished_name ]
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
countryName                     = US
stateOrProvinceName             = Massachusetts
localityName                    = Boston
organizationName                = MyOrganization
organizationalUnitName          = MyOrganization Certification Authority
commonName                      = MyOrganization Root CA
emailAddress                    = admin@myorganization.org

# Optionally, specify some defaults.
countryName_default             = US
stateOrProvinceName_default     = Massachusetts
localityName_default            = Boston
organizationName_default        = MyOrganization
organizationalUnitName_default  = MyOrganization Certification Authority
commonName_default              = MyOrganization Root CA
emailAddress_default            = admin@myorganization.org

[ v3_ca ]
# Extensions for a typical CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ v3_intermediate_ca ]
# Extensions for a typical intermediate CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always
basicConstraints = critical, CA:true, pathlen:1
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ usr_cert ]
# Extensions for client certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, emailProtection

[ server_cert ]
# Extensions for server certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid
keyUsage = critical, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign
extendedKeyUsage = serverAuth

[ crl_ext ]
# Extension for CRLs (`man x509v3_config`).
authorityKeyIdentifier=keyid:always

[ ocsp ]
# Extension for OCSP signing certificates (`man ocsp`).
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, OCSPSigning