Initialize Commit
This commit is contained in:
commit
132eee8091
GPG Key ID:
A40DB907D289BF5A
145
.gitignore
vendored
Normal file
145
.gitignore
vendored
Normal file
@ -0,0 +1,145 @@
|
|||||||
|
# Created by https://www.toptal.com/developers/gitignore/api/rust-analyzer,rust,certificates,visualstudiocode,jetbrains+all
|
||||||
|
# Edit at https://www.toptal.com/developers/gitignore?templates=rust-analyzer,rust,certificates,visualstudiocode,jetbrains+all
|
||||||
|
|
||||||
|
### certificates ###
|
||||||
|
*.pem
|
||||||
|
*.key
|
||||||
|
*.crt
|
||||||
|
*.cer
|
||||||
|
*.der
|
||||||
|
*.priv
|
||||||
|
|
||||||
|
# add jay
|
||||||
|
*.csr
|
||||||
|
*.pub
|
||||||
|
*.srl
|
||||||
|
|
||||||
|
### JetBrains+all ###
|
||||||
|
# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
|
||||||
|
# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
|
||||||
|
|
||||||
|
# User-specific stuff
|
||||||
|
.idea/**/workspace.xml
|
||||||
|
.idea/**/tasks.xml
|
||||||
|
.idea/**/usage.statistics.xml
|
||||||
|
.idea/**/dictionaries
|
||||||
|
.idea/**/shelf
|
||||||
|
|
||||||
|
# AWS User-specific
|
||||||
|
.idea/**/aws.xml
|
||||||
|
|
||||||
|
# Generated files
|
||||||
|
.idea/**/contentModel.xml
|
||||||
|
|
||||||
|
# Sensitive or high-churn files
|
||||||
|
.idea/**/dataSources/
|
||||||
|
.idea/**/dataSources.ids
|
||||||
|
.idea/**/dataSources.local.xml
|
||||||
|
.idea/**/sqlDataSources.xml
|
||||||
|
.idea/**/dynamic.xml
|
||||||
|
.idea/**/uiDesigner.xml
|
||||||
|
.idea/**/dbnavigator.xml
|
||||||
|
|
||||||
|
# Gradle
|
||||||
|
.idea/**/gradle.xml
|
||||||
|
.idea/**/libraries
|
||||||
|
|
||||||
|
# Gradle and Maven with auto-import
|
||||||
|
# When using Gradle or Maven with auto-import, you should exclude module files,
|
||||||
|
# since they will be recreated, and may cause churn. Uncomment if using
|
||||||
|
# auto-import.
|
||||||
|
# .idea/artifacts
|
||||||
|
# .idea/compiler.xml
|
||||||
|
# .idea/jarRepositories.xml
|
||||||
|
# .idea/modules.xml
|
||||||
|
# .idea/*.iml
|
||||||
|
# .idea/modules
|
||||||
|
# *.iml
|
||||||
|
# *.ipr
|
||||||
|
|
||||||
|
# CMake
|
||||||
|
cmake-build-*/
|
||||||
|
|
||||||
|
# Mongo Explorer plugin
|
||||||
|
.idea/**/mongoSettings.xml
|
||||||
|
|
||||||
|
# File-based project format
|
||||||
|
*.iws
|
||||||
|
|
||||||
|
# IntelliJ
|
||||||
|
out/
|
||||||
|
|
||||||
|
# mpeltonen/sbt-idea plugin
|
||||||
|
.idea_modules/
|
||||||
|
|
||||||
|
# JIRA plugin
|
||||||
|
atlassian-ide-plugin.xml
|
||||||
|
|
||||||
|
# Cursive Clojure plugin
|
||||||
|
.idea/replstate.xml
|
||||||
|
|
||||||
|
# SonarLint plugin
|
||||||
|
.idea/sonarlint/
|
||||||
|
|
||||||
|
# Crashlytics plugin (for Android Studio and IntelliJ)
|
||||||
|
com_crashlytics_export_strings.xml
|
||||||
|
crashlytics.properties
|
||||||
|
crashlytics-build.properties
|
||||||
|
fabric.properties
|
||||||
|
|
||||||
|
# Editor-based Rest Client
|
||||||
|
.idea/httpRequests
|
||||||
|
|
||||||
|
# Android studio 3.1+ serialized cache file
|
||||||
|
.idea/caches/build_file_checksums.ser
|
||||||
|
|
||||||
|
### JetBrains+all Patch ###
|
||||||
|
# Ignore everything but code style settings and run configurations
|
||||||
|
# that are supposed to be shared within teams.
|
||||||
|
|
||||||
|
.idea/*
|
||||||
|
|
||||||
|
!.idea/codeStyles
|
||||||
|
!.idea/runConfigurations
|
||||||
|
|
||||||
|
### Rust ###
|
||||||
|
# Generated by Cargo
|
||||||
|
# will have compiled files and executables
|
||||||
|
debug/
|
||||||
|
target/
|
||||||
|
|
||||||
|
# Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
|
||||||
|
# More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
|
||||||
|
Cargo.lock
|
||||||
|
|
||||||
|
# These are backup files generated by rustfmt
|
||||||
|
**/*.rs.bk
|
||||||
|
|
||||||
|
# MSVC Windows builds of rustc generate these, which store debugging information
|
||||||
|
*.pdb
|
||||||
|
|
||||||
|
### rust-analyzer ###
|
||||||
|
# Can be generated by other build systems other than cargo (ex: bazelbuild/rust_rules)
|
||||||
|
rust-project.json
|
||||||
|
|
||||||
|
|
||||||
|
### VisualStudioCode ###
|
||||||
|
.vscode/*
|
||||||
|
!.vscode/settings.json
|
||||||
|
!.vscode/tasks.json
|
||||||
|
!.vscode/launch.json
|
||||||
|
!.vscode/extensions.json
|
||||||
|
!.vscode/*.code-snippets
|
||||||
|
|
||||||
|
# Local History for Visual Studio Code
|
||||||
|
.history/
|
||||||
|
|
||||||
|
# Built Visual Studio Code Extensions
|
||||||
|
*.vsix
|
||||||
|
|
||||||
|
### VisualStudioCode Patch ###
|
||||||
|
# Ignore all local history of files
|
||||||
|
.history
|
||||||
|
.ionide
|
||||||
|
|
||||||
|
# End of https://www.toptal.com/developers/gitignore/api/rust-analyzer,rust,certificates,visualstudiocode,jetbrains+all
|
||||||
16
Cargo.toml
Normal file
16
Cargo.toml
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
[package]
|
||||||
|
name = "TcpExample"
|
||||||
|
version = "0.1.0"
|
||||||
|
edition = "2021"
|
||||||
|
|
||||||
|
[dependencies]
|
||||||
|
log = "0.4.22"
|
||||||
|
pretty_env_logger = "0.5.0"
|
||||||
|
rustls = "0.23.12"
|
||||||
|
rustls-native-certs = "0.7.1"
|
||||||
|
rustls-pemfile = "2.1.2"
|
||||||
|
tokio = "1.39.2"
|
||||||
|
tokio-rustls = "0.26.0"
|
||||||
|
webpki = "0.22.4"
|
||||||
|
webpki-roots = "0.26.3"
|
||||||
|
x509-parser = "0.16.0"
|
||||||
40
README.md
Normal file
40
README.md
Normal file
@ -0,0 +1,40 @@
|
|||||||
|
# TLS on Rust and PKI
|
||||||
|
|
||||||
|
## How to Build
|
||||||
|
```bash
|
||||||
|
$ cargo build
|
||||||
|
```
|
||||||
|
|
||||||
|
## Run TLS Server
|
||||||
|
```bash
|
||||||
|
$ cargo run --bin TcpExample certs/host/fullchain.pem certs/host/server.key
|
||||||
|
```
|
||||||
|
|
||||||
|
## Run TLS Client
|
||||||
|
```bash
|
||||||
|
# EXEC_TARGET=client
|
||||||
|
$ EXEC_TARGET=allow_any_cert_client
|
||||||
|
$ cargo run --bin $EXEC_TARGET certs/rootca/rootCA.crt
|
||||||
|
```
|
||||||
|
|
||||||
|
## Make rootCA Certificate
|
||||||
|
```bash
|
||||||
|
$ cd certs/rootca
|
||||||
|
# edit rootca.conf
|
||||||
|
$ ./bootstrap cert_name
|
||||||
|
```
|
||||||
|
|
||||||
|
## Make ICA Certificate
|
||||||
|
```bash
|
||||||
|
$ cd certs/ica
|
||||||
|
# edit ica.conf
|
||||||
|
$ ./bootstrap cert_name
|
||||||
|
```
|
||||||
|
|
||||||
|
## Make Server Certificate
|
||||||
|
```bash
|
||||||
|
$ cd certs/host
|
||||||
|
# edit host.conf
|
||||||
|
$ ./bootstrap cert_name
|
||||||
|
```
|
||||||
|
|
||||||
18
certs/host/bootstrap.sh
Executable file
18
certs/host/bootstrap.sh
Executable file
@ -0,0 +1,18 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
echo "Create $1 Server"
|
||||||
|
openssl genpkey -algorithm EC -out $1.key -pkeyopt ec_paramgen_curve:P-384 -pkeyopt ec_param_enc:named_curve
|
||||||
|
|
||||||
|
openssl req -new -config host.conf -key $1.key -out $1.csr
|
||||||
|
|
||||||
|
openssl x509 -req -days 730 -in $1.csr -out $1.crt -extfile host.conf -extensions v3_ext \
|
||||||
|
-CAkey $2 -CA $3 -CAcreateserial
|
||||||
|
|
||||||
|
openssl ec -in $1.key -pubout -out $1.pub
|
||||||
|
|
||||||
|
openssl x509 -in $1.crt -text -pubkey -noout
|
||||||
|
|
||||||
|
cat $1.pub
|
||||||
|
|
||||||
|
cat $1.crt $3 > fullchain.pem
|
||||||
|
|
||||||
43
certs/host/host.conf
Normal file
43
certs/host/host.conf
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
# Modify this files to your needs
|
||||||
|
|
||||||
|
[req]
|
||||||
|
default_bits = 384
|
||||||
|
distinguished_name = dn
|
||||||
|
default_md = sha256
|
||||||
|
prompt = no
|
||||||
|
req_extensions = req_ext
|
||||||
|
|
||||||
|
[dn]
|
||||||
|
C="KR"
|
||||||
|
ST="Seoul"
|
||||||
|
L="Seoul"
|
||||||
|
O="SCOPE.Inc"
|
||||||
|
OU="SCOPE Lab"
|
||||||
|
emailAddress="jay3920@scope.co.kr"
|
||||||
|
CN="Invalid Test"
|
||||||
|
|
||||||
|
[req_ext]
|
||||||
|
subjectAltName = @alt_names
|
||||||
|
|
||||||
|
[ v3_ext]
|
||||||
|
authorityKeyIdentifier = keyid,issuer:always
|
||||||
|
basicConstraints = CA:FALSE
|
||||||
|
subjectKeyIdentifier = hash
|
||||||
|
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
|
||||||
|
extendedKeyUsage = serverAuth
|
||||||
|
subjectAltName = @alt_names
|
||||||
|
|
||||||
|
[ v3_ext_client]
|
||||||
|
authorityKeyIdentifier = keyid,issuer:always
|
||||||
|
basicConstraints = CA:FALSE
|
||||||
|
subjectKeyIdentifier = hash
|
||||||
|
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
|
||||||
|
extendedKeyUsage = clientAuth
|
||||||
|
subjectAltName = @alt_names
|
||||||
|
|
||||||
|
[alt_names]
|
||||||
|
DNS.1 = www.scope.co.kr
|
||||||
|
DNS.2 = *.scope.co.kr
|
||||||
|
IP.1 = 10.1.3.63
|
||||||
|
IP.2 = 10.1.3.69
|
||||||
|
IP.3 = 10.1.3.80
|
||||||
16
certs/ica/bootstrap.sh
Executable file
16
certs/ica/bootstrap.sh
Executable file
@ -0,0 +1,16 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
echo "Create $1 ICA"
|
||||||
|
openssl genpkey -algorithm EC -out $1.key -pkeyopt ec_paramgen_curve:P-384 -pkeyopt ec_param_enc:named_curve
|
||||||
|
|
||||||
|
openssl req -new -config ica.conf -key $1.key -out $1.csr
|
||||||
|
|
||||||
|
openssl x509 -req -days 730 -in $1.csr -out $1.crt -extfile ../rootca/rootca.conf -extensions v3_intermediate_ca \
|
||||||
|
-CAkey $2 -CA $3 -CAcreateserial
|
||||||
|
|
||||||
|
openssl ec -in $1.key -pubout -out $1.pub
|
||||||
|
|
||||||
|
openssl x509 -in $1.crt -text -pubkey -noout
|
||||||
|
|
||||||
|
cat $1.pub
|
||||||
|
|
||||||
132
certs/ica/ica.conf
Normal file
132
certs/ica/ica.conf
Normal file
@ -0,0 +1,132 @@
|
|||||||
|
[ ca ]
|
||||||
|
# `man ca`
|
||||||
|
default_ca = CA_default
|
||||||
|
|
||||||
|
[ CA_default ]
|
||||||
|
# # Directory and file locations.
|
||||||
|
# dir = /root/ca/intermediate
|
||||||
|
# certs = $dir/certs
|
||||||
|
# crl_dir = $dir/crl
|
||||||
|
# new_certs_dir = $dir/newcerts
|
||||||
|
# database = $dir/index.txt
|
||||||
|
# serial = $dir/serial
|
||||||
|
# RANDFILE = $dir/private/.rand
|
||||||
|
|
||||||
|
# # The root key and root certificate.
|
||||||
|
# private_key = $dir/private/intermediate.key.pem
|
||||||
|
# certificate = $dir/certs/intermediate.cert.pem
|
||||||
|
|
||||||
|
# # For certificate revocation lists.
|
||||||
|
# crlnumber = $dir/crlnumber
|
||||||
|
# crl = $dir/crl/intermediate.crl.pem
|
||||||
|
# crl_extensions = crl_ext
|
||||||
|
# default_crl_days = 30
|
||||||
|
|
||||||
|
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||||
|
default_md = sha256
|
||||||
|
|
||||||
|
name_opt = ca_default
|
||||||
|
cert_opt = ca_default
|
||||||
|
default_days = 375
|
||||||
|
preserve = no
|
||||||
|
policy = policy_loose
|
||||||
|
|
||||||
|
[ policy_strict ]
|
||||||
|
# The root CA should only sign intermediate certificates that match.
|
||||||
|
# See the POLICY FORMAT section of `man ca`.
|
||||||
|
countryName = match
|
||||||
|
stateOrProvinceName = match
|
||||||
|
organizationName = match
|
||||||
|
organizationalUnitName = optional
|
||||||
|
commonName = supplied
|
||||||
|
emailAddress = optional
|
||||||
|
|
||||||
|
[ policy_loose ]
|
||||||
|
# Allow the intermediate CA to sign a more diverse range of certificates.
|
||||||
|
# See the POLICY FORMAT section of the `ca` man page.
|
||||||
|
countryName = optional
|
||||||
|
stateOrProvinceName = optional
|
||||||
|
localityName = optional
|
||||||
|
organizationName = optional
|
||||||
|
organizationalUnitName = optional
|
||||||
|
commonName = supplied
|
||||||
|
emailAddress = optional
|
||||||
|
|
||||||
|
[ req ]
|
||||||
|
# Options for the `req` tool (`man req`).
|
||||||
|
default_bits = 384
|
||||||
|
distinguished_name = req_distinguished_name
|
||||||
|
string_mask = utf8only
|
||||||
|
prompt = no
|
||||||
|
encrypt_key = no
|
||||||
|
|
||||||
|
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||||
|
default_md = sha256
|
||||||
|
|
||||||
|
# Extension to add when the -x509 option is used.
|
||||||
|
x509_extensions = v3_ca
|
||||||
|
|
||||||
|
[ req_distinguished_name ]
|
||||||
|
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
|
||||||
|
countryName = KR
|
||||||
|
stateOrProvinceName = Seoul
|
||||||
|
localityName = seoul
|
||||||
|
0.organizationName = SCOPE.Inc
|
||||||
|
organizationalUnitName = SCOPE Lab
|
||||||
|
commonName = SCOPE ICA (Lab)
|
||||||
|
emailAddress = scopelab@scope.co.kr
|
||||||
|
|
||||||
|
# Optionally, specify some defaults.
|
||||||
|
# countryName_default = TR
|
||||||
|
# stateOrProvinceName_default = Istanbul
|
||||||
|
# localityName_default = Istanbul
|
||||||
|
# 0.organizationName_default = Safderun
|
||||||
|
# organizationalUnitName_default = Safderun Intermediate CA
|
||||||
|
# commonName_default = Safderun Intermediate CA
|
||||||
|
# emailAddress_default = burakberkkeskin@gmail.com
|
||||||
|
|
||||||
|
[ v3_ca ]
|
||||||
|
# Extensions for a typical CA (`man x509v3_config`).
|
||||||
|
subjectKeyIdentifier = hash
|
||||||
|
authorityKeyIdentifier = keyid:always,issuer
|
||||||
|
basicConstraints = critical, CA:true
|
||||||
|
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
|
||||||
|
|
||||||
|
[ v3_intermediate_ca ]
|
||||||
|
# Extensions for a typical intermediate CA (`man x509v3_config`).
|
||||||
|
subjectKeyIdentifier = hash
|
||||||
|
authorityKeyIdentifier = keyid:always,issuer
|
||||||
|
basicConstraints = critical, CA:true, pathlen:0
|
||||||
|
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
|
||||||
|
|
||||||
|
[ usr_cert ]
|
||||||
|
# Extensions for client certificates (`man x509v3_config`).
|
||||||
|
basicConstraints = CA:FALSE
|
||||||
|
nsCertType = client, email
|
||||||
|
nsComment = "OpenSSL Generated Client Certificate"
|
||||||
|
subjectKeyIdentifier = hash
|
||||||
|
authorityKeyIdentifier = keyid,issuer
|
||||||
|
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
|
||||||
|
extendedKeyUsage = clientAuth, emailProtection
|
||||||
|
|
||||||
|
[ server_cert ]
|
||||||
|
# Extensions for server certificates (`man x509v3_config`).
|
||||||
|
basicConstraints = CA:FALSE
|
||||||
|
nsCertType = server
|
||||||
|
nsComment = "OpenSSL Generated Server Certificate"
|
||||||
|
subjectKeyIdentifier = hash
|
||||||
|
authorityKeyIdentifier = keyid,issuer:always
|
||||||
|
keyUsage = critical, digitalSignature, keyEncipherment
|
||||||
|
extendedKeyUsage = serverAuth
|
||||||
|
|
||||||
|
[ crl_ext ]
|
||||||
|
# Extension for CRLs (`man x509v3_config`).
|
||||||
|
authorityKeyIdentifier=keyid:always
|
||||||
|
|
||||||
|
[ ocsp ]
|
||||||
|
# Extension for OCSP signing certificates (`man ocsp`).
|
||||||
|
basicConstraints = CA:FALSE
|
||||||
|
subjectKeyIdentifier = hash
|
||||||
|
authorityKeyIdentifier = keyid,issuer
|
||||||
|
keyUsage = critical, digitalSignature
|
||||||
|
extendedKeyUsage = critical, OCSPSigning
|
||||||
16
certs/rootca/bootstrap.sh
Executable file
16
certs/rootca/bootstrap.sh
Executable file
@ -0,0 +1,16 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
echo "Create $1 Host"
|
||||||
|
|
||||||
|
openssl genpkey -algorithm EC -out $1.key -pkeyopt ec_paramgen_curve:P-384 -pkeyopt ec_param_enc:named_curve
|
||||||
|
|
||||||
|
openssl req -x509 -new -days 730 -key $1.key -out $1.crt -config rootca.conf
|
||||||
|
|
||||||
|
openssl ec -in $1.key -pubout -out $1.pub
|
||||||
|
|
||||||
|
openssl x509 -in $1.crt -text -pubkey -noout
|
||||||
|
|
||||||
|
cat $1.pub
|
||||||
|
|
||||||
|
|
||||||
|
# openssl req -x509 -days 3650 -new -key ${CANAME}.key -out ${CANAME}.crt -config rootca_openssl.conf
|
||||||
132
certs/rootca/rootca.conf
Normal file
132
certs/rootca/rootca.conf
Normal file
@ -0,0 +1,132 @@
|
|||||||
|
[ ca ]
|
||||||
|
# `man ca`
|
||||||
|
default_ca = CA_default
|
||||||
|
|
||||||
|
[ CA_default ]
|
||||||
|
# Directory and file locations.
|
||||||
|
# dir = /etc/ssl/localCA/rootCA
|
||||||
|
# certs = $dir/certs
|
||||||
|
# crl_dir = $dir/crl
|
||||||
|
# new_certs_dir = $dir/newcerts
|
||||||
|
# database = $dir/index.txt
|
||||||
|
# serial = $dir/serial
|
||||||
|
# RANDFILE = $dir/private/.rand
|
||||||
|
|
||||||
|
# # The root key and root certificate.
|
||||||
|
# private_key = $dir/rootCA.key
|
||||||
|
# certificate = $dir/rootCA.crt
|
||||||
|
|
||||||
|
# # For certificate revocation lists.
|
||||||
|
# crlnumber = $dir/crlnumber
|
||||||
|
# crl = $dir/crl/ca.crl.pem
|
||||||
|
# crl_extensions = crl_ext
|
||||||
|
# default_crl_days = 30
|
||||||
|
|
||||||
|
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||||
|
default_md = sha256
|
||||||
|
|
||||||
|
name_opt = ca_default
|
||||||
|
cert_opt = ca_default
|
||||||
|
default_days = 3650
|
||||||
|
preserve = no
|
||||||
|
policy = policy_strict
|
||||||
|
|
||||||
|
[ policy_strict ]
|
||||||
|
# The root CA should only sign intermediate certificates that match.
|
||||||
|
# See the POLICY FORMAT section of `man ca`.
|
||||||
|
countryName = match
|
||||||
|
stateOrProvinceName = match
|
||||||
|
organizationName = match
|
||||||
|
organizationalUnitName = optional
|
||||||
|
commonName = supplied
|
||||||
|
emailAddress = optional
|
||||||
|
|
||||||
|
[ policy_loose ]
|
||||||
|
# Allow the intermediate CA to sign a more diverse range of certificates.
|
||||||
|
# See the POLICY FORMAT section of the `ca` man page.
|
||||||
|
countryName = optional
|
||||||
|
stateOrProvinceName = optional
|
||||||
|
localityName = optional
|
||||||
|
organizationName = optional
|
||||||
|
organizationalUnitName = optional
|
||||||
|
commonName = supplied
|
||||||
|
emailAddress = optional
|
||||||
|
|
||||||
|
[ req ]
|
||||||
|
# Options for the `req` tool (`man req`).
|
||||||
|
default_bits = 384
|
||||||
|
distinguished_name = req_distinguished_name
|
||||||
|
string_mask = utf8only
|
||||||
|
prompt = no
|
||||||
|
encrypt_key = no
|
||||||
|
|
||||||
|
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||||
|
default_md = sha256
|
||||||
|
|
||||||
|
# Extension to add when the -x509 option is used.
|
||||||
|
req_extensions = v3_ca
|
||||||
|
|
||||||
|
[ req_distinguished_name ]
|
||||||
|
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
|
||||||
|
countryName = KR
|
||||||
|
stateOrProvinceName = Seoul
|
||||||
|
localityName = seoul
|
||||||
|
0.organizationName = SCOPE.Inc
|
||||||
|
organizationalUnitName = SCOPE.Inc
|
||||||
|
commonName = SCOPE Self Sign CA
|
||||||
|
emailAddress = sos@scope.co.kr
|
||||||
|
|
||||||
|
# # Optionally, specify some defaults.
|
||||||
|
# countryName_default = KR
|
||||||
|
# stateOrProvinceName_default = Seoul
|
||||||
|
# localityName_default = Seoul
|
||||||
|
# 0.organizationName_default = SCOPE.Inc
|
||||||
|
# organizationalUnitName_default = SCOPE.Inc
|
||||||
|
# commonName_default = SCOPE Self Sign CA
|
||||||
|
# emailAddress_default = sos@scope.co.kr
|
||||||
|
|
||||||
|
[ v3_ca ]
|
||||||
|
# Extensions for a typical CA (`man x509v3_config`).
|
||||||
|
subjectKeyIdentifier = hash
|
||||||
|
authorityKeyIdentifier = keyid:always,issuer
|
||||||
|
basicConstraints = critical, CA:true
|
||||||
|
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
|
||||||
|
|
||||||
|
[ v3_intermediate_ca ]
|
||||||
|
# Extensions for a typical intermediate CA (`man x509v3_config`).
|
||||||
|
subjectKeyIdentifier = hash
|
||||||
|
authorityKeyIdentifier = keyid:always,issuer
|
||||||
|
basicConstraints = critical, CA:true, pathlen:0
|
||||||
|
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
|
||||||
|
|
||||||
|
[ usr_cert ]
|
||||||
|
# Extensions for client certificates (`man x509v3_config`).
|
||||||
|
basicConstraints = CA:FALSE
|
||||||
|
nsCertType = client, email
|
||||||
|
nsComment = "OpenSSL Generated Client Certificate"
|
||||||
|
subjectKeyIdentifier = hash
|
||||||
|
authorityKeyIdentifier = keyid,issuer
|
||||||
|
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
|
||||||
|
extendedKeyUsage = clientAuth, emailProtection
|
||||||
|
|
||||||
|
[ server_cert ]
|
||||||
|
# Extensions for server certificates (`man x509v3_config`).
|
||||||
|
basicConstraints = CA:FALSE
|
||||||
|
nsCertType = server
|
||||||
|
nsComment = "OpenSSL Generated Server Certificate"
|
||||||
|
subjectKeyIdentifier = hash
|
||||||
|
authorityKeyIdentifier = keyid,issuer:always
|
||||||
|
keyUsage = critical, digitalSignature, keyEncipherment
|
||||||
|
extendedKeyUsage = serverAuth
|
||||||
|
|
||||||
|
[ crl_ext ]
|
||||||
|
# Extension for CRLs (`man x509v3_config`).
|
||||||
|
authorityKeyIdentifier=keyid:always
|
||||||
|
|
||||||
|
[ ocsp ]
|
||||||
|
# Extension for OCSP signing certificates (`man ocsp`).
|
||||||
|
basicConstraints = CA:FALSE
|
||||||
|
subjectKeyIdentifier = hash
|
||||||
|
authorityKeyIdentifier = keyid,issuer
|
||||||
|
keyUsage = critical, digitalSignature
|
||||||
|
extendedKeyUsage = critical, OCSPSigning
|
||||||
Loading…
Reference in New Issue
Block a user