ka
/
ansible-role-certificate_authority
1
0
Креирај огранак 0
Код Дискусије 0 Захтеви за спајање 0 Издања 0 Вики Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
4 Комити
1 Грана
31KB
Дрво: d4c2edf02a
Гране Ознаке
${ item.name }
Create branch ${ searchTerm }
from 'd4c2edf02a'
${ noResults }
ansible-role-certificate_au.../templates/ca.cnf.j2

127 lines
4.2KB
Датотека Blame Историја 

  1. {{ ansible_managed | comment }}

  2. 

  3. [ ca ]

  4. # `man ca`

  5. default_ca = CA_default

  6. 

  7. [ CA_default ]

  8. # Directory and file locations.

  9. dir               = {{ certificate_authority_directory }}

  10. certs             = $dir/certs

  11. crl_dir           = $dir/crl

  12. new_certs_dir     = $dir/newcerts

  13. database          = $dir/index

  14. serial            = $dir/serial

  15. RANDFILE          = $dir/private/.rand

  16. 

  17. # The root key and root certificate.

  18. private_key       = $dir/private/ca.key.pem

  19. certificate       = $dir/certs/ca.cert.pem

  20. 

  21. # For certificate revocation lists.

  22. crlnumber         = $dir/crlnumber

  23. crl               = $dir/crl/ca.crl.pem

  24. crl_extensions    = crl_ext

  25. default_crl_days  = 30

  26. 

  27. # SHA-1 is deprecated, so use SHA-2 instead.

  28. default_md        = sha256

  29. 

  30. name_opt          = ca_default

  31. cert_opt          = ca_default

  32. preserve          = no

  33. policy            = policy_{{ certificate_authority_policy }}

  34. 

  35. copy_extensions   = copy

  36. 

  37. default_enddate   = {{ lookup('pipe','date -u --date="'+(certificate_authority_enddate|string)+'" +%Y%m%d%H%M%SZ') }}

  38. 

  39. [ policy_strict ]

  40. # The root CA should only sign intermediate certificates that match.

  41. # See the POLICY FORMAT section of `man ca`.

  42. countryName             = match

  43. stateOrProvinceName     = match

  44. organizationName        = match

  45. organizationalUnitName  = optional

  46. commonName              = supplied

  47. emailAddress            = optional

  48. 

  49. [ policy_strict_org ]

  50. # The root CA should only sign intermediate certificates that match.

  51. # See the POLICY FORMAT section of `man ca`.

  52. countryName             = optional

  53. stateOrProvinceName     = optional

  54. organizationName        = match

  55. organizationalUnitName  = optional

  56. commonName              = supplied

  57. emailAddress            = optional

  58. 

  59. [ policy_loose ]

  60. # Allow the intermediate CA to sign a more diverse range of certificates.

  61. # See the POLICY FORMAT section of the `ca` man page.

  62. countryName             = optional

  63. stateOrProvinceName     = optional

  64. localityName            = optional

  65. organizationName        = optional

  66. organizationalUnitName  = optional

  67. commonName              = supplied

  68. emailAddress            = optional

  69. 

  70. [ req ]

  71. # Options for the `req` tool (`man req`).

  72. default_bits        = 2048

  73. distinguished_name  = req_distinguished_name

  74. string_mask         = utf8only

  75. 

  76. # SHA-1 is deprecated, so use SHA-2 instead.

  77. default_md          = sha256

  78. 

  79. # Extension to add when the -x509 option is used.

  80. #x509_extensions     = v3_ca

  81. 

  82. [ req_distinguished_name ]

  83. # See <https://en.wikipedia.org/wiki/Certificate_signing_request>.

  84. countryName                     = Country Name (2 letter code)

  85. stateOrProvinceName             = State or Province Name

  86. localityName                    = Locality Name

  87. 0.organizationName              = Organization Name

  88. organizationalUnitName          = Organizational Unit Name

  89. commonName                      = Common Name

  90. emailAddress                    = Email Address

  91. 

  92. # Optionally, specify some defaults.

  93. countryName_default             = {{ certificate_authority_country | default('') }}

  94. stateOrProvinceName_default     = {{ certificate_authority_state | default('') }}

  95. localityName_default            = {{ certificate_authority_locality | default('') }}

  96. 0.organizationName_default      = {{ certificate_authority_organization | default('') }}

  97. organizationalUnitName_default  = {{ certificate_authority_organizational_unit | default('') }}

  98. #emailAddress_default           =

  99. 

  100. [ usr_cert ]

  101. # Extensions for client certificates (`man x509v3_config`).

  102. basicConstraints = CA:FALSE

  103. subjectKeyIdentifier = hash

  104. authorityKeyIdentifier = keyid,issuer:always

  105. keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment

  106. extendedKeyUsage = clientAuth, emailProtection

  107. 

  108. [ server_cert ]

  109. # Extensions for server certificates (`man x509v3_config`).

  110. basicConstraints = CA:FALSE

  111. subjectKeyIdentifier = hash

  112. authorityKeyIdentifier = keyid,issuer:always

  113. keyUsage = critical, digitalSignature, keyEncipherment

  114. extendedKeyUsage = serverAuth

  115. 

  116. [ crl_ext ]

  117. # Extension for CRLs (`man x509v3_config`).

  118. authorityKeyIdentifier=keyid:always

  119. 

  120. [ ocsp ]

  121. # Extension for OCSP signing certificates (`man ocsp`).

  122. basicConstraints = CA:FALSE

  123. subjectKeyIdentifier = hash

  124. authorityKeyIdentifier = keyid,issuer

  125. keyUsage = critical, digitalSignature

  126. extendedKeyUsage = critical, OCSPSigning