bin/openssl/openssl.cnf - master - cuthbert/sb.api_COMobject

bin/openssl/openssl.cnf
155 строк6 KB
sVs02
Загрузить файлы в «»
28 май 2026, 15:30
28 май 2026, 15:302afcb7f
# main config file for openSSL ver. 3.0

openssl_conf           = openssl_def
HOME                   = .
RANDFILE               = $ENV::HOME/CA/private/.rand
oid_section            = new_oids

[ new_oids ]
#tsa_policy1 = 1.2.3.4.1
#tsa_policy2 = 1.2.3.4.5.6
#tsa_policy3 = 1.2.3.4.5.7

# Настройки удостоверяющего центра
[ ca ]
default_ca             = CA_default

[ CA_default ]
# описание папок и файлов для хранения сертификатов.
dir                    = ./CA
certs                  = $dir/certs
new_certs_dir          = $dir/newcerts
database               = $dir/index.txt
serial                 = $dir/serial
RANDFILE               = $dir/private/.rand

# The root key and root certificate.
private_key            = $dir/private/cakey.pem
certificate            = $dir/cacert.pem

# For certificate revocation lists.
crlnumber              = $dir/crlnumber
copy_extensions        = copy
default_days           = 365
default_crl_days       = 30

default_md             = md_gost12_256             # алгоритм хеширования по умолчанию

name_opt               = ca_default
cert_opt               = ca_default
policy                 = policy_strict
email_in_dn            = no

[ policy_strict ]
# Корневой центр сертификации подписывает только те промежуточные сертификаты, которые соответствуют друг другу.
# Обязательность полей в запросе на CA сертификат
countryName            = supplied
stateOrProvinceName    = optional
organizationName       = optional
organizationalUnitName = optional
commonName             = supplied
emailAddress           = optional

[ policy_loose ]
# Промежуточный центр сертификации подписывает более широкий спектр сертификатов.
countryName            = optional
localityName           = optional
organizationName       = optional
organizationalUnitName = optional
commonName             = supplied
title                  = optional
emailAddress           = optional

# Настройки создания запросов на сертификат
[ req ]
prompt                 = no
default_bits           = 2048
distinguished_name     = req_distinguished_name
string_mask            = utf8only

# Extension to add when the -x509 option is used.
x509_extensions        = v3_ca
req_extensions         = ext

[ req_distinguished_name ]
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
countryName            = Country Name (2 letter code)
stateOrProvinceName    = State or Province Name
localityName           = Locality Name
organizationName       = Organization Name
organizationalUnitName = Organizational Unit Name
commonName             = Common Name
emailAddress           = Email Address

# Расширения сертификата
[ ext ]
subjectSignTool        = ASN1:FORMAT:UTF8,UTF8String:СКЗИ \"Рутокен ЭЦП 2.0\"
extendedKeyUsage       = emailProtection
keyUsage               = digitalSignature, nonRepudiation, keyEncipherment, cdataEncipherment

[ v3_ca ]
# Extensions for a typical CA (`man x509v3_config`).
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints       = critical, CA:true
keyUsage               = critical, digitalSignature, cRLSign, keyCertSign

[ v3_intermediate_ca ]
# Extensions for a typical intermediate CA (`man x509v3_config`).
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints       = critical, CA:true, pathlen:0
keyUsage               = critical, digitalSignature, cRLSign, keyCertSign

[ usr_cert ]
# Extensions for client certificates (`man x509v3_config`).
basicConstraints       = CA:FALSE
nsCertType             = client, email
nsComment              = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid,issuer
keyUsage               = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage       = clientAuth, emailProtection


#-----------------  section TSA  ------------------#
[ tsa ]
default_tsa           = tsa_config

[ tsa_config ]
dir                   = ./CA
serial                = $dir/tsa_serial
signer_cert           = $dir/tsacert.pem
signer_key            = $dir/private/tsakey.pem
signer_digest         = md_gost12_256
default_policy        = 1.2.3.4
digests               = md_gost94,md_gost12_256,md_gost12_512
tsa_name              = yes
ess_cert_id_chain     = yes
ess_cert_id_alg       = md_gost12_256

[ tsa_ext ]
basicConstraints      = critical,CA:false
extendedKeyUsage      = critical,timeStamping
keyUsage              = critical,nonRepudiation
subjectKeyIdentifier  = hash

######################################################################
###        section "GOST algoritm"                                 ###
###    для выпуска сертификата по ГОСТ Р 34.10-2012                ###
###    используются разработка компании "Atlassian Corporation"    ###
###    продукт - СКЗИ "Рутокен ЭЦП 2.0"                            ###
###    описание доступно по ссылке https://dev.rutoken.ru/         ###
######################################################################

[ openssl_def ]
engines               = engine_section

[ engine_section ]
rutoken               = gost_section

[ gost_section ]
dynamic_path          = ./rtengine.dll
enable_rand           = no
default_algorithms    = ALL
engine_id             = rutoken