###############################################################
## openssl.conf - generated by django-pki
###############################################################

HOME = $ENV::PKI_DIR
RANDFILE = $HOME/.rnd
S_A_N = "undefined"
C_D_P = "undefined"

###############################################################
## CA definitions
###############################################################

[ ca ]
default_ca               = ___DummyCA___

[ ___DummyCA___ ]
dir                      = $HOME/___DummyCA___
certs                    = $dir/certs
new_certs_dir            = $certs
database                 = $dir/index.txt
certificate              = $dir/___DummyCA___.cert.pem
private_key              = $dir/private/___DummyCA___.key.pem
serial                   = $dir/serial
crldir                   = $dir/crl
crlnumber                = $dir/crlnumber
crl                      = $crldir/___DummyCA___.crl.pem
RANDFILE                 = $dir/private/.rnd
x509_extensions          = v3_ca
copy_extensions          = copy
name_opt                 = ca_default
cert_opt                 = ca_default
default_md               = sha1
preserve                 = no
policy                   = policy_match

{% for ca in ca_list %}
## {{ ca.description }}
[ {{ ca.name }} ]
dir                      = $HOME/{{ ca.name }}
certs                    = $dir/certs
new_certs_dir            = $certs
database                 = $dir/index.txt
certificate              = $certs/{{ ca.name }}.cert.pem
private_key              = $dir/private/{{ ca.name }}.key.pem
serial                   = $dir/serial
crldir                   = $dir/crl
crlnumber                = $dir/crlnumber
crl                      = $crldir/{{ ca.name }}.crl.pem
RANDFILE                 = $dir/private/.rnd
x509_extensions          = {{ ca.extension }}
copy_extensions          = copy
name_opt                 = ca_default
cert_opt                 = ca_default
default_md               = sha1
preserve                 = no
policy                   = policy_anything
{% endfor %}

###############################################################
## Policy definitions
###############################################################

[ policy_match ]
commonName                      = supplied
countryName                     = match
stateOrProvinceName             = match
localityName                    = match
organizationName                = match
organizationalUnitName          = optional
emailAddress                    = optional

[ policy_anything ]
commonName                      = supplied
countryName                     = supplied
stateOrProvinceName             = supplied
localityName                    = supplied
organizationName                = supplied
organizationalUnitName          = optional
emailAddress                    = optional

###############################################################
## Request defaults
###############################################################

[ req ]
default_bits                    = 1024
default_keyfile                 = privkey.pem
distinguished_name              = req_distinguished_name
attributes                      = req_attributes
string_mask                     = nombstr

[ req_distinguished_name ]
commonName                      = Common Name (eg, your name or your server's hostname)
commonName_max                  = 64
countryName                     = Country Name (2 letter code)
countryName_default             = DE
countryName_min                 = 2
countryName_max                 = 2
stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = Bavaria
localityName                    = Locality Name (eg, city)
localityName_default            = Munich
0.organizationName              = Organization Name (eg, company)
0.organizationName_default      = Bozo Inc. Clown Factory
organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default  = BackEnd
subjectAltName                  = Alias Name (eg, for a system hosting several SSL services)
subjectAltName_max              = 64
emailAddress                    = Email Address
emailAddress_max                = 64

[ req_attributes ]

###############################################################
## x509 extensions
###############################################################

{% for x509 in x509_extensions %}
## {{ x509.description }}
[ {{ x509.name }} ]
basicConstraints = {% if x509.basic_constraints_critical %}critical,{% endif %}{{ x509.basic_constraints }}
keyUsage = {{ x509.key_usage_csv }}
subjectKeyIdentifier = {{ x509.subject_key_identifier }}
authorityKeyIdentifier = {{ x509.authority_key_identifier }}
{% if x509.ext_key_usage_csv %}extendedKeyUsage = {{ x509.ext_key_usage_csv }}{% endif %}
{% if not x509.ca %}subjectAltName = ${ENV::S_A_N}{% endif %}
{% if x509.crl_distribution_point %}crlDistributionPoints = ${ENV::C_D_P}{% endif %}
{% endfor %}
