ca.cnf

OTP是开放电信平台的简称

# Purpose: Configuration for CAs.

ROOTDIR	        = $ENV::ROOTDIR
default_ca	= ca

[ca]
dir		= $ROOTDIR/erlangCA
certs		= $dir/certs
crl_dir	        = $dir/crl
database	        = $dir/index.txt
new_certs_dir	= $dir/newcerts
certificate	= $dir/cert.pem
serial		= $dir/serial
crl		= $dir/crl.pem
private_key	= $dir/private/key.pem
RANDFILE	        = $dir/private/RAND

x509_extensions   = user_cert
default_days	= 3600
default_md	= sha1
preserve	        = no
policy		= policy_match

[policy_match]
commonName		= supplied
organizationalUnitName	= optional
organizationName	        = match
countryName		= match
localityName		= match
emailAddress		= supplied

[user_cert]
basicConstraints	= CA:false
keyUsage 		= nonRepudiation, digitalSignature, keyEncipherment
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
subjectAltName	= email:copy
issuerAltName	= issuer:copy

[ca_cert]
basicConstraints 	= critical,CA:true
keyUsage 		= cRLSign, keyCertSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
subjectAltName	= email:copy
issuerAltName	= issuer:copy