28 lines
865 B
INI
28 lines
865 B
INI
[ usr_cert ]
|
|
|
|
# These extensions are added when 'ca' signs a request.
|
|
|
|
# This goes against PKIX guidelines but some CAs do it and some software
|
|
# requires this to avoid interpreting an end user certificate as a CA.
|
|
|
|
basicConstraints=CA:FALSE
|
|
|
|
# This is typical in keyUsage for a client certificate.
|
|
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
|
|
|
# PKIX recommendations harmless if included in all certificates.
|
|
subjectKeyIdentifier=hash
|
|
authorityKeyIdentifier=keyid,issuer
|
|
|
|
# This stuff is for subjectAltName and issuerAltname.
|
|
# Import the email address.
|
|
#subjectAltName=email:copy dns:copy ip:copy
|
|
# An alternative to produce certificates that aren't
|
|
# deprecated according to PKIX.
|
|
# subjectAltName=email:move
|
|
|
|
# Copy subject details
|
|
# issuerAltName=issuer:copy
|
|
|
|
# This is required for TSA certificates.
|
|
# extendedKeyUsage = critical,timeStamping
|