[thirdparty/openssl.git] / apps / openssl.cnf

#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#

# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .
RANDFILE		= $ENV::HOME/.rnd

# Extra OBJECT IDENTIFIER info:
#oid_file		= $ENV::HOME/.oid
oid_section		= new_oids

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		= 
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]

# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7

####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

####################################################################
[ CA_default ]

dir		= ./demoCA		# Where everything is kept
certs		= $dir/certs		# Where the issued certs are kept
crl_dir		= $dir/crl		# Where the issued crl are kept
database	= $dir/index.txt	# database index file.
#unique_subject	= no			# Set to 'no' to allow creation of
					# several ctificates with same subject.
new_certs_dir	= $dir/newcerts		# default place for new certs.

certificate	= $dir/cacert.pem 	# The CA certificate
serial		= $dir/serial 		# The current serial number
crlnumber	= $dir/crlnumber	# the current crl number
					# must be commented out to leave a V1 CRL
crl		= $dir/crl.pem 		# The current CRL
private_key	= $dir/private/cakey.pem# The private key
RANDFILE	= $dir/private/.rand	# private random number file

x509_extensions	= usr_cert		# The extensions to add to the cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

# Extension copying option: use with caution.
# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions	= crl_ext

default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= default		# use public key default MD
preserve	= no			# keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_match

# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

####################################################################
[ req ]
default_bits		= 1024
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca	# The extensions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options. 
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= AU
countryName_min			= 2
countryName_max			= 2

stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= Some-State

localityName			= Locality Name (eg, city)

0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= Internet Widgits Pty Ltd

# we can do this but it is not needed normally :-)
#1.organizationName		= Second Organization Name (eg, company)
#1.organizationName_default	= World Wide Web Pty Ltd

organizationalUnitName		= Organizational Unit Name (eg, section)
#organizationalUnitName_default	=

commonName			= Common Name (e.g. server FQDN or YOUR name)
commonName_max			= 64

emailAddress			= Email Address
emailAddress_max		= 64

# SET-ex3			= SET extension number 3

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

unstructuredName		= An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType			= server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment			= "OpenSSL Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

# This is required for TSA certificates.
# extendedKeyUsage = critical,timeStamping

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]


# Extensions for a typical CA


# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer

# This is what PKIX recommends but some broken software chokes on critical
# extensions.
#basicConstraints = critical,CA:true
# So we do this instead.
basicConstraints = CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Some might want this also
# nsCertType = sslCA, emailCA

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always

[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType			= server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment			= "OpenSSL Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

####################################################################
[ tsa ]

default_tsa = tsa_config1	# the default TSA section

[ tsa_config1 ]

# These are used by the TSA reply generation only.
dir		= ./demoCA		# TSA root directory
serial		= $dir/tsaserial	# The current serial number (mandatory)
crypto_device	= builtin		# OpenSSL engine to use for signing
signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
					# (optional)
certs		= $dir/cacert.pem	# Certificate chain to include in reply
					# (optional)
signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)

default_policy	= tsa_policy1		# Policy if request did not specify it
					# (optional)
other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
digests		= md5, sha1		# Acceptable message digests (mandatory)
accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
clock_precision_digits  = 0	# number of digits after dot. (optional)
ordering		= yes	# Is ordering defined for timestamps?
				# (optional, default: no)
tsa_name		= yes	# Must the TSA name be included in the reply?
				# (optional, default: no)
ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
				# (optional, default: no)
Commit	Line	Data
d02b48c6	1	#
06d5b162	2	# OpenSSL example configuration file.
d02b48c6 RE	3	# This is mostly being used for generation of certificate requests.
	4	#
	5
36217a94 DSH	6	# This definition stops the following lines choking if HOME isn't
	7	# defined.
	8	HOME = .
d02b48c6	9	RANDFILE = $ENV::HOME/.rnd
20432eae DSH	10
	11	# Extra OBJECT IDENTIFIER info:
	12	#oid_file = $ENV::HOME/.oid
a43aa73e DSH	13	oid_section = new_oids
a43aa73e DSH	14
3f45ed82	15	# To use this configuration file with the "-extfile" option of the
e186bf96 BM	16	# "openssl x509" utility, name here the section containing the
	17	# X.509v3 extensions to use:
	18	# extensions =
	19	# (Alternatively, use a configuration file that has only
	20	# X.509v3 extensions in its main [= default] section.)
	21
a43aa73e DSH	22	[ new_oids ]
a43aa73e DSH	23
c7235be6	24	# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
a43aa73e DSH	25	# Add a simple OID like this:
	26	# testoid1=1.2.3.4
	27	# Or use config file substitution like this:
	28	# testoid2=${testoid1}.5.6
d02b48c6	29
c7235be6 UM	30	# Policies used by the TSA examples.
	31	tsa_policy1 = 1.2.3.4.1
	32	tsa_policy2 = 1.2.3.4.5.6
	33	tsa_policy3 = 1.2.3.4.5.7
	34
d02b48c6 RE	35	####################################################################
	36	[ ca ]
	37	default_ca = CA_default # The default ca section
	38
	39	####################################################################
	40	[ CA_default ]
	41
	42	dir = ./demoCA # Where everything is kept
	43	certs = $dir/certs # Where the issued certs are kept
	44	crl_dir = $dir/crl # Where the issued crl are kept
	45	database = $dir/index.txt # database index file.
f85b68cd RL	46	#unique_subject = no # Set to 'no' to allow creation of
f85b68cd RL	47	# several ctificates with same subject.
d02b48c6 RE	48	new_certs_dir = $dir/newcerts # default place for new certs.
	49
	50	certificate = $dir/cacert.pem # The CA certificate
	51	serial = $dir/serial # The current serial number
fd4ef699 RL	52	crlnumber = $dir/crlnumber # the current crl number
fd4ef699 RL	53	# must be commented out to leave a V1 CRL
d02b48c6 RE	54	crl = $dir/crl.pem # The current CRL
	55	private_key = $dir/private/cakey.pem# The private key
	56	RANDFILE = $dir/private/.rand # private random number file
	57
478b50cf	58	x509_extensions = usr_cert # The extensions to add to the cert
257e206d	59
e890dcdb DSH	60	# Comment out the following two lines for the "traditional"
	61	# (and highly broken) format.
	62	name_opt = ca_default # Subject Name options
	63	cert_opt = ca_default # Certificate field options
	64
791bd0cd DSH	65	# Extension copying option: use with caution.
	66	# copy_extensions = copy
	67
257e206d DSH	68	# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
257e206d DSH	69	# so this is commented out by default to leave a V1 CRL.
fd4ef699	70	# crlnumber must also be commented out to leave a V1 CRL.
257e206d DSH	71	# crl_extensions = crl_ext
257e206d DSH	72
d02b48c6 RE	73	default_days = 365 # how long to certify for
d02b48c6 RE	74	default_crl_days= 30 # how long before next CRL
03919683	75	default_md = default # use public key default MD
d02b48c6 RE	76	preserve = no # keep passed DN ordering
	77
	78	# A few difference way of specifying how similar the request should look
	79	# For type CA, the listed attributes must be the same, and the optional
	80	# and supplied fields are just that :-)
	81	policy = policy_match
	82
	83	# For the CA policy
	84	[ policy_match ]
	85	countryName = match
	86	stateOrProvinceName = match
	87	organizationName = match
	88	organizationalUnitName = optional
	89	commonName = supplied
	90	emailAddress = optional
	91
	92	# For the 'anything' policy
	93	# At this point in time, you must list all acceptable 'object'
	94	# types.
	95	[ policy_anything ]
	96	countryName = optional
	97	stateOrProvinceName = optional
	98	localityName = optional
	99	organizationName = optional
	100	organizationalUnitName = optional
	101	commonName = supplied
	102	emailAddress = optional
	103
	104	####################################################################
	105	[ req ]
	106	default_bits = 1024
	107	default_keyfile = privkey.pem
	108	distinguished_name = req_distinguished_name
	109	attributes = req_attributes
478b50cf	110	x509_extensions = v3_ca # The extensions to add to the self signed cert
d02b48c6	111
36217a94 DSH	112	# Passwords for private keys if not present they will be prompted for
	113	# input_password = secret
	114	# output_password = secret
	115
b38f9f66	116	# This sets a mask for permitted string types. There are several options.
74400f73	117	# default: PrintableString, T61String, BMPString.
29b9763d DSH	118	# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
29b9763d DSH	119	# utf8only: only UTF8Strings (PKIX recommendation after 2004).
b38f9f66	120	# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
74400f73	121	# MASK:XXXX a literal mask value.
29b9763d DSH	122	# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
29b9763d DSH	123	string_mask = utf8only
74400f73	124
c79b16e1 DSH	125	# req_extensions = v3_req # The extensions to add to a certificate request
c79b16e1 DSH	126
d02b48c6 RE	127	[ req_distinguished_name ]
	128	countryName = Country Name (2 letter code)
	129	countryName_default = AU
	130	countryName_min = 2
	131	countryName_max = 2
	132
	133	stateOrProvinceName = State or Province Name (full name)
	134	stateOrProvinceName_default = Some-State
	135
	136	localityName = Locality Name (eg, city)
	137
	138	0.organizationName = Organization Name (eg, company)
	139	0.organizationName_default = Internet Widgits Pty Ltd
	140
	141	# we can do this but it is not needed normally :-)
	142	#1.organizationName = Second Organization Name (eg, company)
06d5b162	143	#1.organizationName_default = World Wide Web Pty Ltd
d02b48c6 RE	144
	145	organizationalUnitName = Organizational Unit Name (eg, section)
	146	#organizationalUnitName_default =
	147
df0cdf4c	148	commonName = Common Name (e.g. server FQDN or YOUR name)
d02b48c6 RE	149	commonName_max = 64
	150
	151	emailAddress = Email Address
d8c2adae	152	emailAddress_max = 64
d02b48c6	153
a43aa73e	154	# SET-ex3 = SET extension number 3
dfeab068	155
d02b48c6 RE	156	[ req_attributes ]
	157	challengePassword = A challenge password
	158	challengePassword_min = 4
	159	challengePassword_max = 20
	160
	161	unstructuredName = An optional company name
	162
b2347661	163	[ usr_cert ]
d02b48c6	164
b2347661	165	# These extensions are added when 'ca' signs a request.
d02b48c6	166
b2347661 DSH	167	# This goes against PKIX guidelines but some CAs do it and some software
b2347661 DSH	168	# requires this to avoid interpreting an end user certificate as a CA.
d02b48c6	169
b2347661 DSH	170	basicConstraints=CA:FALSE
	171
	172	# Here are some examples of the usage of nsCertType. If it is omitted
	173	# the certificate can be used for anything except object signing.
	174
	175	# This is OK for an SSL server.
257e206d	176	# nsCertType = server
b2347661 DSH	177
b2347661 DSH	178	# For an object signing certificate this would be used.
257e206d	179	# nsCertType = objsign
b2347661 DSH	180
b2347661 DSH	181	# For normal client use this is typical
257e206d	182	# nsCertType = client, email
b2347661	183
257e206d DSH	184	# and for everything including object signing:
257e206d DSH	185	# nsCertType = client, email, objsign
b2347661	186
257e206d DSH	187	# This is typical in keyUsage for a client certificate.
257e206d DSH	188	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
b2347661	189
257e206d	190	# This will be displayed in Netscape's comment listbox.
b2347661	191	nsComment = "OpenSSL Generated Certificate"
0be9747b	192
257e206d	193	# PKIX recommendations harmless if included in all certificates.
175b0942	194	subjectKeyIdentifier=hash
29b9763d	195	authorityKeyIdentifier=keyid,issuer
0be9747b	196
257e206d	197	# This stuff is for subjectAltName and issuerAltname.
aa066b9e	198	# Import the email address.
257e206d	199	# subjectAltName=email:copy
ed2e24d5 RL	200	# An alternative to produce certificates that aren't
	201	# deprecated according to PKIX.
	202	# subjectAltName=email:move
aa066b9e DSH	203
aa066b9e DSH	204	# Copy subject details
257e206d	205	# issuerAltName=issuer:copy
b2347661 DSH	206
b2347661 DSH	207	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
d02b48c6 RE	208	#nsBaseUrl
	209	#nsRevocationUrl
	210	#nsRenewalUrl
	211	#nsCaPolicyUrl
	212	#nsSslServerName
d02b48c6	213
c7235be6	214	# This is required for TSA certificates.
54565832	215	# extendedKeyUsage = critical,timeStamping
c7235be6	216
c79b16e1 DSH	217	[ v3_req ]
	218
	219	# Extensions to add to a certificate request
	220
	221	basicConstraints = CA:FALSE
	222	keyUsage = nonRepudiation, digitalSignature, keyEncipherment
	223
5a97a0b6	224	[ v3_ca ]
f317aa4c	225
c79b16e1	226
f317aa4c DSH	227	# Extensions for a typical CA
f317aa4c DSH	228
f317aa4c	229
175b0942 DSH	230	# PKIX recommendation.
	231
	232	subjectKeyIdentifier=hash
	233
06ddf8eb	234	authorityKeyIdentifier=keyid:always,issuer
0be9747b	235
b2347661 DSH	236	# This is what PKIX recommends but some broken software chokes on critical
	237	# extensions.
	238	#basicConstraints = critical,CA:true
257e206d DSH	239	# So we do this instead.
257e206d DSH	240	basicConstraints = CA:true
b2347661	241
257e206d DSH	242	# Key usage: this is typical for a CA certificate. However since it will
	243	# prevent it being used as an test self-signed certificate it is best
	244	# left out by default.
	245	# keyUsage = cRLSign, keyCertSign
f317aa4c	246
b2347661	247	# Some might want this also
257e206d	248	# nsCertType = sslCA, emailCA
388ff0b0	249
aa066b9e	250	# Include email address in subject alt name: another PKIX recommendation
257e206d	251	# subjectAltName=email:copy
aa066b9e	252	# Copy issuer details
257e206d	253	# issuerAltName=issuer:copy
aa066b9e	254
c79b16e1 DSH	255	# DER hex encoding of an extension: beware experts only!
	256	# obj=DER:02:03
	257	# Where 'obj' is a standard or added object
388ff0b0	258	# You can even override a supported extension:
c79b16e1	259	# basicConstraints= critical, DER:30:03:01:01:FF
1756d405 DSH	260
	261	[ crl_ext ]
	262
	263	# CRL extensions.
	264	# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
	265
257e206d	266	# issuerAltName=issuer:copy
06ddf8eb	267	authorityKeyIdentifier=keyid:always
6951c23a RL	268
	269	[ proxy_cert_ext ]
	270	# These extensions should be added when creating a proxy certificate
	271
	272	# This goes against PKIX guidelines but some CAs do it and some software
	273	# requires this to avoid interpreting an end user certificate as a CA.
	274
	275	basicConstraints=CA:FALSE
	276
	277	# Here are some examples of the usage of nsCertType. If it is omitted
	278	# the certificate can be used for anything except object signing.
	279
	280	# This is OK for an SSL server.
	281	# nsCertType = server
	282
	283	# For an object signing certificate this would be used.
	284	# nsCertType = objsign
	285
	286	# For normal client use this is typical
	287	# nsCertType = client, email
	288
	289	# and for everything including object signing:
	290	# nsCertType = client, email, objsign
	291
	292	# This is typical in keyUsage for a client certificate.
	293	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
	294
	295	# This will be displayed in Netscape's comment listbox.
	296	nsComment = "OpenSSL Generated Certificate"
	297
	298	# PKIX recommendations harmless if included in all certificates.
	299	subjectKeyIdentifier=hash
06ddf8eb	300	authorityKeyIdentifier=keyid,issuer
6951c23a RL	301
	302	# This stuff is for subjectAltName and issuerAltname.
	303	# Import the email address.
	304	# subjectAltName=email:copy
	305	# An alternative to produce certificates that aren't
	306	# deprecated according to PKIX.
	307	# subjectAltName=email:move
	308
	309	# Copy subject details
	310	# issuerAltName=issuer:copy
	311
	312	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
	313	#nsBaseUrl
	314	#nsRevocationUrl
	315	#nsRenewalUrl
	316	#nsCaPolicyUrl
	317	#nsSslServerName
	318
	319	# This really needs to be in place for it to be a proxy certificate.
	320	proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
c7235be6 UM	321
	322	####################################################################
	323	[ tsa ]
	324
	325	default_tsa = tsa_config1 # the default TSA section
	326
	327	[ tsa_config1 ]
	328
	329	# These are used by the TSA reply generation only.
	330	dir = ./demoCA # TSA root directory
	331	serial = $dir/tsaserial # The current serial number (mandatory)
	332	crypto_device = builtin # OpenSSL engine to use for signing
	333	signer_cert = $dir/tsacert.pem # The TSA signing certificate
	334	# (optional)
	335	certs = $dir/cacert.pem # Certificate chain to include in reply
	336	# (optional)
	337	signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
	338
	339	default_policy = tsa_policy1 # Policy if request did not specify it
	340	# (optional)
	341	other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
	342	digests = md5, sha1 # Acceptable message digests (mandatory)
	343	accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
	344	clock_precision_digits = 0 # number of digits after dot. (optional)
	345	ordering = yes # Is ordering defined for timestamps?
	346	# (optional, default: no)
	347	tsa_name = yes # Must the TSA name be included in the reply?
	348	# (optional, default: no)
	349	ess_cert_id_chain = no # Must the ESS cert id chain be included?
	350	# (optional, default: no)