[thirdparty/openssl.git] / apps / openssl-vms.cnf

#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#

# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .
RANDFILE		= $ENV::HOME/.rnd

# Extra OBJECT IDENTIFIER info:
#oid_file		= $ENV::HOME/.oid
oid_section		= new_oids

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		= 
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]

# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7

####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

####################################################################
[ CA_default ]

dir		= sys\$disk:[.demoCA		# Where everything is kept
certs		= $dir.certs]		# Where the issued certs are kept
crl_dir		= $dir.crl]		# Where the issued crl are kept
database	= $dir]index.txt	# database index file.
#unique_subject	= no			# Set to 'no' to allow creation of
					# several ctificates with same subject.
new_certs_dir	= $dir.newcerts]		# default place for new certs.

certificate	= $dir]cacert.pem 	# The CA certificate
serial		= $dir]serial. 		# The current serial number
crlnumber	= $dir]crlnumber.	# the current crl number
					# must be commented out to leave a V1 CRL
crl		= $dir]crl.pem 		# The current CRL
private_key	= $dir.private]cakey.pem# The private key
RANDFILE	= $dir.private].rand	# private random number file

x509_extensions	= usr_cert		# The extentions to add to the cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

# Extension copying option: use with caution.
# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions	= crl_ext

default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= default		# use public key default MD
preserve	= no			# keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_match

# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

####################################################################
[ req ]
default_bits		= 1024
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca	# The extentions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options. 
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= AU
countryName_min			= 2
countryName_max			= 2

stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= Some-State

localityName			= Locality Name (eg, city)

0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= Internet Widgits Pty Ltd

# we can do this but it is not needed normally :-)
#1.organizationName		= Second Organization Name (eg, company)
#1.organizationName_default	= World Wide Web Pty Ltd

organizationalUnitName		= Organizational Unit Name (eg, section)
#organizationalUnitName_default	=

commonName			= Common Name (e.g. server FQDN or YOUR name)
commonName_max			= 64

emailAddress			= Email Address
emailAddress_max		= 64

# SET-ex3			= SET extension number 3

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

unstructuredName		= An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType			= server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment			= "OpenSSL Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

# This is required for TSA certificates.
# extendedKeyUsage = critical,timeStamping

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]


# Extensions for a typical CA


# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer

# This is what PKIX recommends but some broken software chokes on critical
# extensions.
#basicConstraints = critical,CA:true
# So we do this instead.
basicConstraints = CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Some might want this also
# nsCertType = sslCA, emailCA

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always

[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType			= server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment			= "OpenSSL Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

####################################################################
[ tsa ]

default_tsa = tsa_config1	# the default TSA section

[ tsa_config1 ]

# These are used by the TSA reply generation only.
dir		= sys\$disk:[.demoCA		# TSA root directory
serial		= $dir]tsaserial.	# The current serial number (mandatory)
crypto_device	= builtin		# OpenSSL engine to use for signing
signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
					# (optional)
certs		= $dir.cacert.pem]	# Certificate chain to include in reply
					# (optional)
signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)

default_policy	= tsa_policy1		# Policy if request did not specify it
					# (optional)
other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
digests		= md5, sha1		# Acceptable message digests (mandatory)
accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
clock_precision_digits  = 0	# number of digits after dot. (optional)
ordering		= yes	# Is ordering defined for timestamps?
				# (optional, default: no)
tsa_name		= yes	# Must the TSA name be included in the reply?
				# (optional, default: no)
ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
				# (optional, default: no)
Commit	Line	Data
7d7d2cbc UM	1	#
	2	# OpenSSL example configuration file.
	3	# This is mostly being used for generation of certificate requests.
	4	#
	5
d1739eb2 RL	6	# This definition stops the following lines choking if HOME isn't
	7	# defined.
	8	HOME = .
9dff4cc0	9	RANDFILE = $ENV::HOME/.rnd
d1739eb2 RL	10
	11	# Extra OBJECT IDENTIFIER info:
	12	#oid_file = $ENV::HOME/.oid
7d7d2cbc UM	13	oid_section = new_oids
7d7d2cbc UM	14
9dff4cc0 UM	15	# To use this configuration file with the "-extfile" option of the
	16	# "openssl x509" utility, name here the section containing the
	17	# X.509v3 extensions to use:
	18	# extensions =
	19	# (Alternatively, use a configuration file that has only
	20	# X.509v3 extensions in its main [= default] section.)
	21
7d7d2cbc UM	22	[ new_oids ]
7d7d2cbc UM	23
c7235be6	24	# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
7d7d2cbc UM	25	# Add a simple OID like this:
	26	# testoid1=1.2.3.4
	27	# Or use config file substitution like this:
	28	# testoid2=${testoid1}.5.6
	29
c7235be6 UM	30	# Policies used by the TSA examples.
	31	tsa_policy1 = 1.2.3.4.1
	32	tsa_policy2 = 1.2.3.4.5.6
	33	tsa_policy3 = 1.2.3.4.5.7
	34
7d7d2cbc UM	35	####################################################################
	36	[ ca ]
	37	default_ca = CA_default # The default ca section
	38
	39	####################################################################
	40	[ CA_default ]
	41
d1739eb2	42	dir = sys\$disk:[.demoCA # Where everything is kept
7d7d2cbc UM	43	certs = $dir.certs] # Where the issued certs are kept
	44	crl_dir = $dir.crl] # Where the issued crl are kept
	45	database = $dir]index.txt # database index file.
d1739eb2 RL	46	#unique_subject = no # Set to 'no' to allow creation of
	47	# several ctificates with same subject.
	48	new_certs_dir = $dir.newcerts] # default place for new certs.
7d7d2cbc UM	49
7d7d2cbc UM	50	certificate = $dir]cacert.pem # The CA certificate
d1739eb2 RL	51	serial = $dir]serial. # The current serial number
	52	crlnumber = $dir]crlnumber. # the current crl number
	53	# must be commented out to leave a V1 CRL
7d7d2cbc UM	54	crl = $dir]crl.pem # The current CRL
	55	private_key = $dir.private]cakey.pem# The private key
	56	RANDFILE = $dir.private].rand # private random number file
	57
	58	x509_extensions = usr_cert # The extentions to add to the cert
9dff4cc0	59
d1739eb2 RL	60	# Comment out the following two lines for the "traditional"
	61	# (and highly broken) format.
	62	name_opt = ca_default # Subject Name options
	63	cert_opt = ca_default # Certificate field options
	64
	65	# Extension copying option: use with caution.
	66	# copy_extensions = copy
	67
9dff4cc0 UM	68	# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
9dff4cc0 UM	69	# so this is commented out by default to leave a V1 CRL.
d1739eb2	70	# crlnumber must also be commented out to leave a V1 CRL.
9dff4cc0 UM	71	# crl_extensions = crl_ext
9dff4cc0 UM	72
7d7d2cbc UM	73	default_days = 365 # how long to certify for
7d7d2cbc UM	74	default_crl_days= 30 # how long before next CRL
98bf13c3	75	default_md = default # use public key default MD
7d7d2cbc UM	76	preserve = no # keep passed DN ordering
	77
	78	# A few difference way of specifying how similar the request should look
	79	# For type CA, the listed attributes must be the same, and the optional
	80	# and supplied fields are just that :-)
	81	policy = policy_match
	82
	83	# For the CA policy
	84	[ policy_match ]
	85	countryName = match
	86	stateOrProvinceName = match
	87	organizationName = match
	88	organizationalUnitName = optional
	89	commonName = supplied
	90	emailAddress = optional
	91
	92	# For the 'anything' policy
	93	# At this point in time, you must list all acceptable 'object'
	94	# types.
	95	[ policy_anything ]
	96	countryName = optional
	97	stateOrProvinceName = optional
	98	localityName = optional
	99	organizationName = optional
	100	organizationalUnitName = optional
	101	commonName = supplied
	102	emailAddress = optional
	103
	104	####################################################################
	105	[ req ]
	106	default_bits = 1024
	107	default_keyfile = privkey.pem
	108	distinguished_name = req_distinguished_name
	109	attributes = req_attributes
	110	x509_extensions = v3_ca # The extentions to add to the self signed cert
	111
d1739eb2 RL	112	# Passwords for private keys if not present they will be prompted for
	113	# input_password = secret
	114	# output_password = secret
	115
	116	# This sets a mask for permitted string types. There are several options.
849c0fe2	117	# default: PrintableString, T61String, BMPString.
9ab899a6 RL	118	# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
9ab899a6 RL	119	# utf8only: only UTF8Strings (PKIX recommendation after 2004).
d1739eb2	120	# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
849c0fe2	121	# MASK:XXXX a literal mask value.
9ab899a6 RL	122	# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
9ab899a6 RL	123	string_mask = utf8only
849c0fe2 RL	124
	125	# req_extensions = v3_req # The extensions to add to a certificate request
	126
7d7d2cbc UM	127	[ req_distinguished_name ]
	128	countryName = Country Name (2 letter code)
	129	countryName_default = AU
	130	countryName_min = 2
	131	countryName_max = 2
	132
	133	stateOrProvinceName = State or Province Name (full name)
	134	stateOrProvinceName_default = Some-State
	135
	136	localityName = Locality Name (eg, city)
	137
	138	0.organizationName = Organization Name (eg, company)
	139	0.organizationName_default = Internet Widgits Pty Ltd
	140
	141	# we can do this but it is not needed normally :-)
	142	#1.organizationName = Second Organization Name (eg, company)
	143	#1.organizationName_default = World Wide Web Pty Ltd
	144
	145	organizationalUnitName = Organizational Unit Name (eg, section)
	146	#organizationalUnitName_default =
	147
5c05f694	148	commonName = Common Name (e.g. server FQDN or YOUR name)
7d7d2cbc UM	149	commonName_max = 64
	150
	151	emailAddress = Email Address
d1739eb2	152	emailAddress_max = 64
7d7d2cbc UM	153
	154	# SET-ex3 = SET extension number 3
	155
	156	[ req_attributes ]
	157	challengePassword = A challenge password
	158	challengePassword_min = 4
	159	challengePassword_max = 20
	160
	161	unstructuredName = An optional company name
	162
	163	[ usr_cert ]
	164
	165	# These extensions are added when 'ca' signs a request.
	166
	167	# This goes against PKIX guidelines but some CAs do it and some software
	168	# requires this to avoid interpreting an end user certificate as a CA.
	169
	170	basicConstraints=CA:FALSE
	171
	172	# Here are some examples of the usage of nsCertType. If it is omitted
	173	# the certificate can be used for anything except object signing.
	174
	175	# This is OK for an SSL server.
9dff4cc0	176	# nsCertType = server
7d7d2cbc UM	177
7d7d2cbc UM	178	# For an object signing certificate this would be used.
9dff4cc0	179	# nsCertType = objsign
7d7d2cbc UM	180
7d7d2cbc UM	181	# For normal client use this is typical
9dff4cc0	182	# nsCertType = client, email
7d7d2cbc	183
9dff4cc0 UM	184	# and for everything including object signing:
9dff4cc0 UM	185	# nsCertType = client, email, objsign
7d7d2cbc	186
9dff4cc0 UM	187	# This is typical in keyUsage for a client certificate.
9dff4cc0 UM	188	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
7d7d2cbc	189
9dff4cc0	190	# This will be displayed in Netscape's comment listbox.
7d7d2cbc UM	191	nsComment = "OpenSSL Generated Certificate"
7d7d2cbc UM	192
9dff4cc0	193	# PKIX recommendations harmless if included in all certificates.
7d7d2cbc	194	subjectKeyIdentifier=hash
c7235be6	195	authorityKeyIdentifier=keyid,issuer
7d7d2cbc	196
9dff4cc0	197	# This stuff is for subjectAltName and issuerAltname.
7d7d2cbc	198	# Import the email address.
9dff4cc0	199	# subjectAltName=email:copy
d1739eb2 RL	200	# An alternative to produce certificates that aren't
	201	# deprecated according to PKIX.
	202	# subjectAltName=email:move
7d7d2cbc UM	203
7d7d2cbc UM	204	# Copy subject details
9dff4cc0	205	# issuerAltName=issuer:copy
7d7d2cbc UM	206
	207	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
	208	#nsBaseUrl
	209	#nsRevocationUrl
	210	#nsRenewalUrl
	211	#nsCaPolicyUrl
	212	#nsSslServerName
	213
c7235be6	214	# This is required for TSA certificates.
96afc1cf	215	# extendedKeyUsage = critical,timeStamping
c7235be6	216
849c0fe2 RL	217	[ v3_req ]
	218
	219	# Extensions to add to a certificate request
	220
	221	basicConstraints = CA:FALSE
	222	keyUsage = nonRepudiation, digitalSignature, keyEncipherment
	223
	224	[ v3_ca ]
	225
7d7d2cbc UM	226
	227	# Extensions for a typical CA
	228
7d7d2cbc UM	229
	230	# PKIX recommendation.
	231
	232	subjectKeyIdentifier=hash
	233
71d3eaf3	234	authorityKeyIdentifier=keyid:always,issuer
7d7d2cbc UM	235
	236	# This is what PKIX recommends but some broken software chokes on critical
	237	# extensions.
	238	#basicConstraints = critical,CA:true
9dff4cc0 UM	239	# So we do this instead.
9dff4cc0 UM	240	basicConstraints = CA:true
7d7d2cbc	241
9dff4cc0 UM	242	# Key usage: this is typical for a CA certificate. However since it will
	243	# prevent it being used as an test self-signed certificate it is best
	244	# left out by default.
	245	# keyUsage = cRLSign, keyCertSign
7d7d2cbc UM	246
7d7d2cbc UM	247	# Some might want this also
9dff4cc0	248	# nsCertType = sslCA, emailCA
7d7d2cbc UM	249
7d7d2cbc UM	250	# Include email address in subject alt name: another PKIX recommendation
9dff4cc0	251	# subjectAltName=email:copy
7d7d2cbc	252	# Copy issuer details
9dff4cc0	253	# issuerAltName=issuer:copy
7d7d2cbc	254
849c0fe2 RL	255	# DER hex encoding of an extension: beware experts only!
	256	# obj=DER:02:03
	257	# Where 'obj' is a standard or added object
7d7d2cbc	258	# You can even override a supported extension:
849c0fe2	259	# basicConstraints= critical, DER:30:03:01:01:FF
9dff4cc0 UM	260
	261	[ crl_ext ]
	262
	263	# CRL extensions.
	264	# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
	265
	266	# issuerAltName=issuer:copy
71d3eaf3	267	authorityKeyIdentifier=keyid:always
6951c23a RL	268
	269	[ proxy_cert_ext ]
	270	# These extensions should be added when creating a proxy certificate
	271
	272	# This goes against PKIX guidelines but some CAs do it and some software
	273	# requires this to avoid interpreting an end user certificate as a CA.
	274
	275	basicConstraints=CA:FALSE
	276
	277	# Here are some examples of the usage of nsCertType. If it is omitted
	278	# the certificate can be used for anything except object signing.
	279
	280	# This is OK for an SSL server.
	281	# nsCertType = server
	282
	283	# For an object signing certificate this would be used.
	284	# nsCertType = objsign
	285
	286	# For normal client use this is typical
	287	# nsCertType = client, email
	288
	289	# and for everything including object signing:
	290	# nsCertType = client, email, objsign
	291
	292	# This is typical in keyUsage for a client certificate.
	293	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
	294
	295	# This will be displayed in Netscape's comment listbox.
	296	nsComment = "OpenSSL Generated Certificate"
	297
	298	# PKIX recommendations harmless if included in all certificates.
	299	subjectKeyIdentifier=hash
71d3eaf3	300	authorityKeyIdentifier=keyid,issuer
6951c23a RL	301
	302	# This stuff is for subjectAltName and issuerAltname.
	303	# Import the email address.
	304	# subjectAltName=email:copy
	305	# An alternative to produce certificates that aren't
	306	# deprecated according to PKIX.
	307	# subjectAltName=email:move
	308
	309	# Copy subject details
	310	# issuerAltName=issuer:copy
	311
	312	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
	313	#nsBaseUrl
	314	#nsRevocationUrl
	315	#nsRenewalUrl
	316	#nsCaPolicyUrl
	317	#nsSslServerName
	318
	319	# This really needs to be in place for it to be a proxy certificate.
	320	proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
c7235be6 UM	321
	322	####################################################################
	323	[ tsa ]
	324
	325	default_tsa = tsa_config1 # the default TSA section
	326
	327	[ tsa_config1 ]
	328
	329	# These are used by the TSA reply generation only.
	330	dir = sys\$disk:[.demoCA # TSA root directory
	331	serial = $dir]tsaserial. # The current serial number (mandatory)
	332	crypto_device = builtin # OpenSSL engine to use for signing
	333	signer_cert = $dir/tsacert.pem # The TSA signing certificate
	334	# (optional)
	335	certs = $dir.cacert.pem] # Certificate chain to include in reply
	336	# (optional)
	337	signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
	338
	339	default_policy = tsa_policy1 # Policy if request did not specify it
	340	# (optional)
	341	other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
	342	digests = md5, sha1 # Acceptable message digests (mandatory)
	343	accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
	344	clock_precision_digits = 0 # number of digits after dot. (optional)
	345	ordering = yes # Is ordering defined for timestamps?
	346	# (optional, default: no)
	347	tsa_name = yes # Must the TSA name be included in the reply?
	348	# (optional, default: no)
	349	ess_cert_id_chain = no # Must the ESS cert id chain be included?
	350	# (optional, default: no)