[thirdparty/openssl.git] / apps / openssl.cnf

#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#

# Note that you can include other files from the main configuration
# file using the .include directive.
#.include filename

# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .
RANDFILE		= $ENV::HOME/.rnd

# Extra OBJECT IDENTIFIER info:
#oid_file		= $ENV::HOME/.oid
oid_section		= new_oids

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		= 
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]

# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7

####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

####################################################################
[ CA_default ]

dir		= ./demoCA		# Where everything is kept
certs		= $dir/certs		# Where the issued certs are kept
crl_dir		= $dir/crl		# Where the issued crl are kept
database	= $dir/index.txt	# database index file.
#unique_subject	= no			# Set to 'no' to allow creation of
					# several certs with same subject.
new_certs_dir	= $dir/newcerts		# default place for new certs.

certificate	= $dir/cacert.pem 	# The CA certificate
serial		= $dir/serial 		# The current serial number
crlnumber	= $dir/crlnumber	# the current crl number
					# must be commented out to leave a V1 CRL
crl		= $dir/crl.pem 		# The current CRL
private_key	= $dir/private/cakey.pem# The private key
RANDFILE	= $dir/private/.rand	# private random number file

x509_extensions	= usr_cert		# The extensions to add to the cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

# Extension copying option: use with caution.
# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions	= crl_ext

default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= default		# use public key default MD
preserve	= no			# keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_match

# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

####################################################################
[ req ]
default_bits		= 2048
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca	# The extensions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options. 
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= AU
countryName_min			= 2
countryName_max			= 2

stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= Some-State

localityName			= Locality Name (eg, city)

0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= Internet Widgits Pty Ltd

# we can do this but it is not needed normally :-)
#1.organizationName		= Second Organization Name (eg, company)
#1.organizationName_default	= World Wide Web Pty Ltd

organizationalUnitName		= Organizational Unit Name (eg, section)
#organizationalUnitName_default	=

commonName			= Common Name (e.g. server FQDN or YOUR name)
commonName_max			= 64

emailAddress			= Email Address
emailAddress_max		= 64

# SET-ex3			= SET extension number 3

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

unstructuredName		= An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType			= server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment			= "OpenSSL Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

# This is required for TSA certificates.
# extendedKeyUsage = critical,timeStamping

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]


# Extensions for a typical CA


# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer

basicConstraints = critical,CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Some might want this also
# nsCertType = sslCA, emailCA

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always

[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType			= server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment			= "OpenSSL Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

####################################################################
[ tsa ]

default_tsa = tsa_config1	# the default TSA section

[ tsa_config1 ]

# These are used by the TSA reply generation only.
dir		= ./demoCA		# TSA root directory
serial		= $dir/tsaserial	# The current serial number (mandatory)
crypto_device	= builtin		# OpenSSL engine to use for signing
signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
					# (optional)
certs		= $dir/cacert.pem	# Certificate chain to include in reply
					# (optional)
signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
signer_digest  = sha256			# Signing digest to use. (Optional)
default_policy	= tsa_policy1		# Policy if request did not specify it
					# (optional)
other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
digests     = sha1, sha256, sha384, sha512  # Acceptable message digests (mandatory)
accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
clock_precision_digits  = 0	# number of digits after dot. (optional)
ordering		= yes	# Is ordering defined for timestamps?
				# (optional, default: no)
tsa_name		= yes	# Must the TSA name be included in the reply?
				# (optional, default: no)
ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
				# (optional, default: no)
ess_cert_id_alg		= sha1	# algorithm to compute certificate
				# identifier (optional, default: sha1)
Commit	Line	Data
d02b48c6	1	#
06d5b162	2	# OpenSSL example configuration file.
d02b48c6 RE	3	# This is mostly being used for generation of certificate requests.
	4	#
	5
b524b808 TM	6	# Note that you can include other files from the main configuration
	7	# file using the .include directive.
	8	#.include filename
	9
36217a94 DSH	10	# This definition stops the following lines choking if HOME isn't
	11	# defined.
	12	HOME = .
d02b48c6	13	RANDFILE = $ENV::HOME/.rnd
20432eae DSH	14
	15	# Extra OBJECT IDENTIFIER info:
	16	#oid_file = $ENV::HOME/.oid
a43aa73e DSH	17	oid_section = new_oids
a43aa73e DSH	18
3f45ed82	19	# To use this configuration file with the "-extfile" option of the
e186bf96 BM	20	# "openssl x509" utility, name here the section containing the
	21	# X.509v3 extensions to use:
	22	# extensions =
	23	# (Alternatively, use a configuration file that has only
	24	# X.509v3 extensions in its main [= default] section.)
	25
a43aa73e DSH	26	[ new_oids ]
a43aa73e DSH	27
c7235be6	28	# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
a43aa73e DSH	29	# Add a simple OID like this:
	30	# testoid1=1.2.3.4
	31	# Or use config file substitution like this:
	32	# testoid2=${testoid1}.5.6
d02b48c6	33
c7235be6 UM	34	# Policies used by the TSA examples.
	35	tsa_policy1 = 1.2.3.4.1
	36	tsa_policy2 = 1.2.3.4.5.6
	37	tsa_policy3 = 1.2.3.4.5.7
	38
d02b48c6 RE	39	####################################################################
	40	[ ca ]
	41	default_ca = CA_default # The default ca section
	42
	43	####################################################################
	44	[ CA_default ]
	45
	46	dir = ./demoCA # Where everything is kept
	47	certs = $dir/certs # Where the issued certs are kept
	48	crl_dir = $dir/crl # Where the issued crl are kept
	49	database = $dir/index.txt # database index file.
f85b68cd	50	#unique_subject = no # Set to 'no' to allow creation of
a5a31787	51	# several certs with same subject.
d02b48c6 RE	52	new_certs_dir = $dir/newcerts # default place for new certs.
	53
	54	certificate = $dir/cacert.pem # The CA certificate
	55	serial = $dir/serial # The current serial number
fd4ef699 RL	56	crlnumber = $dir/crlnumber # the current crl number
fd4ef699 RL	57	# must be commented out to leave a V1 CRL
d02b48c6 RE	58	crl = $dir/crl.pem # The current CRL
	59	private_key = $dir/private/cakey.pem# The private key
	60	RANDFILE = $dir/private/.rand # private random number file
	61
478b50cf	62	x509_extensions = usr_cert # The extensions to add to the cert
257e206d	63
e890dcdb DSH	64	# Comment out the following two lines for the "traditional"
	65	# (and highly broken) format.
	66	name_opt = ca_default # Subject Name options
	67	cert_opt = ca_default # Certificate field options
	68
791bd0cd DSH	69	# Extension copying option: use with caution.
	70	# copy_extensions = copy
	71
257e206d DSH	72	# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
257e206d DSH	73	# so this is commented out by default to leave a V1 CRL.
fd4ef699	74	# crlnumber must also be commented out to leave a V1 CRL.
257e206d DSH	75	# crl_extensions = crl_ext
257e206d DSH	76
d02b48c6 RE	77	default_days = 365 # how long to certify for
d02b48c6 RE	78	default_crl_days= 30 # how long before next CRL
03919683	79	default_md = default # use public key default MD
d02b48c6 RE	80	preserve = no # keep passed DN ordering
	81
	82	# A few difference way of specifying how similar the request should look
	83	# For type CA, the listed attributes must be the same, and the optional
	84	# and supplied fields are just that :-)
	85	policy = policy_match
	86
	87	# For the CA policy
	88	[ policy_match ]
	89	countryName = match
	90	stateOrProvinceName = match
	91	organizationName = match
	92	organizationalUnitName = optional
	93	commonName = supplied
	94	emailAddress = optional
	95
	96	# For the 'anything' policy
	97	# At this point in time, you must list all acceptable 'object'
	98	# types.
	99	[ policy_anything ]
	100	countryName = optional
	101	stateOrProvinceName = optional
	102	localityName = optional
	103	organizationName = optional
	104	organizationalUnitName = optional
	105	commonName = supplied
	106	emailAddress = optional
	107
	108	####################################################################
	109	[ req ]
44e0c2ba	110	default_bits = 2048
d02b48c6 RE	111	default_keyfile = privkey.pem
	112	distinguished_name = req_distinguished_name
	113	attributes = req_attributes
478b50cf	114	x509_extensions = v3_ca # The extensions to add to the self signed cert
d02b48c6	115
36217a94 DSH	116	# Passwords for private keys if not present they will be prompted for
	117	# input_password = secret
	118	# output_password = secret
	119
b38f9f66	120	# This sets a mask for permitted string types. There are several options.
74400f73	121	# default: PrintableString, T61String, BMPString.
29b9763d DSH	122	# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
29b9763d DSH	123	# utf8only: only UTF8Strings (PKIX recommendation after 2004).
b38f9f66	124	# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
74400f73	125	# MASK:XXXX a literal mask value.
29b9763d DSH	126	# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
29b9763d DSH	127	string_mask = utf8only
74400f73	128
c79b16e1 DSH	129	# req_extensions = v3_req # The extensions to add to a certificate request
c79b16e1 DSH	130
d02b48c6 RE	131	[ req_distinguished_name ]
	132	countryName = Country Name (2 letter code)
	133	countryName_default = AU
	134	countryName_min = 2
	135	countryName_max = 2
	136
	137	stateOrProvinceName = State or Province Name (full name)
	138	stateOrProvinceName_default = Some-State
	139
	140	localityName = Locality Name (eg, city)
	141
	142	0.organizationName = Organization Name (eg, company)
	143	0.organizationName_default = Internet Widgits Pty Ltd
	144
	145	# we can do this but it is not needed normally :-)
	146	#1.organizationName = Second Organization Name (eg, company)
06d5b162	147	#1.organizationName_default = World Wide Web Pty Ltd
d02b48c6 RE	148
	149	organizationalUnitName = Organizational Unit Name (eg, section)
	150	#organizationalUnitName_default =
	151
df0cdf4c	152	commonName = Common Name (e.g. server FQDN or YOUR name)
d02b48c6 RE	153	commonName_max = 64
	154
	155	emailAddress = Email Address
d8c2adae	156	emailAddress_max = 64
d02b48c6	157
a43aa73e	158	# SET-ex3 = SET extension number 3
dfeab068	159
d02b48c6 RE	160	[ req_attributes ]
	161	challengePassword = A challenge password
	162	challengePassword_min = 4
	163	challengePassword_max = 20
	164
	165	unstructuredName = An optional company name
	166
b2347661	167	[ usr_cert ]
d02b48c6	168
b2347661	169	# These extensions are added when 'ca' signs a request.
d02b48c6	170
b2347661 DSH	171	# This goes against PKIX guidelines but some CAs do it and some software
b2347661 DSH	172	# requires this to avoid interpreting an end user certificate as a CA.
d02b48c6	173
b2347661 DSH	174	basicConstraints=CA:FALSE
	175
	176	# Here are some examples of the usage of nsCertType. If it is omitted
	177	# the certificate can be used for anything except object signing.
	178
	179	# This is OK for an SSL server.
257e206d	180	# nsCertType = server
b2347661 DSH	181
b2347661 DSH	182	# For an object signing certificate this would be used.
257e206d	183	# nsCertType = objsign
b2347661 DSH	184
b2347661 DSH	185	# For normal client use this is typical
257e206d	186	# nsCertType = client, email
b2347661	187
257e206d DSH	188	# and for everything including object signing:
257e206d DSH	189	# nsCertType = client, email, objsign
b2347661	190
257e206d DSH	191	# This is typical in keyUsage for a client certificate.
257e206d DSH	192	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
b2347661	193
257e206d	194	# This will be displayed in Netscape's comment listbox.
b2347661	195	nsComment = "OpenSSL Generated Certificate"
0be9747b	196
257e206d	197	# PKIX recommendations harmless if included in all certificates.
175b0942	198	subjectKeyIdentifier=hash
29b9763d	199	authorityKeyIdentifier=keyid,issuer
0be9747b	200
257e206d	201	# This stuff is for subjectAltName and issuerAltname.
aa066b9e	202	# Import the email address.
257e206d	203	# subjectAltName=email:copy
ed2e24d5 RL	204	# An alternative to produce certificates that aren't
	205	# deprecated according to PKIX.
	206	# subjectAltName=email:move
aa066b9e DSH	207
aa066b9e DSH	208	# Copy subject details
257e206d	209	# issuerAltName=issuer:copy
b2347661 DSH	210
b2347661 DSH	211	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
d02b48c6 RE	212	#nsBaseUrl
	213	#nsRevocationUrl
	214	#nsRenewalUrl
	215	#nsCaPolicyUrl
	216	#nsSslServerName
d02b48c6	217
c7235be6	218	# This is required for TSA certificates.
54565832	219	# extendedKeyUsage = critical,timeStamping
c7235be6	220
c79b16e1 DSH	221	[ v3_req ]
	222
	223	# Extensions to add to a certificate request
	224
	225	basicConstraints = CA:FALSE
	226	keyUsage = nonRepudiation, digitalSignature, keyEncipherment
	227
5a97a0b6	228	[ v3_ca ]
f317aa4c	229
c79b16e1	230
f317aa4c DSH	231	# Extensions for a typical CA
f317aa4c DSH	232
f317aa4c	233
175b0942 DSH	234	# PKIX recommendation.
	235
	236	subjectKeyIdentifier=hash
	237
06ddf8eb	238	authorityKeyIdentifier=keyid:always,issuer
0be9747b	239
a7be5759	240	basicConstraints = critical,CA:true
b2347661	241
257e206d DSH	242	# Key usage: this is typical for a CA certificate. However since it will
	243	# prevent it being used as an test self-signed certificate it is best
	244	# left out by default.
	245	# keyUsage = cRLSign, keyCertSign
f317aa4c	246
b2347661	247	# Some might want this also
257e206d	248	# nsCertType = sslCA, emailCA
388ff0b0	249
aa066b9e	250	# Include email address in subject alt name: another PKIX recommendation
257e206d	251	# subjectAltName=email:copy
aa066b9e	252	# Copy issuer details
257e206d	253	# issuerAltName=issuer:copy
aa066b9e	254
c79b16e1 DSH	255	# DER hex encoding of an extension: beware experts only!
	256	# obj=DER:02:03
	257	# Where 'obj' is a standard or added object
388ff0b0	258	# You can even override a supported extension:
c79b16e1	259	# basicConstraints= critical, DER:30:03:01:01:FF
1756d405 DSH	260
	261	[ crl_ext ]
	262
	263	# CRL extensions.
	264	# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
	265
257e206d	266	# issuerAltName=issuer:copy
06ddf8eb	267	authorityKeyIdentifier=keyid:always
6951c23a RL	268
	269	[ proxy_cert_ext ]
	270	# These extensions should be added when creating a proxy certificate
	271
	272	# This goes against PKIX guidelines but some CAs do it and some software
	273	# requires this to avoid interpreting an end user certificate as a CA.
	274
	275	basicConstraints=CA:FALSE
	276
	277	# Here are some examples of the usage of nsCertType. If it is omitted
	278	# the certificate can be used for anything except object signing.
	279
	280	# This is OK for an SSL server.
	281	# nsCertType = server
	282
	283	# For an object signing certificate this would be used.
	284	# nsCertType = objsign
	285
	286	# For normal client use this is typical
	287	# nsCertType = client, email
	288
	289	# and for everything including object signing:
	290	# nsCertType = client, email, objsign
	291
	292	# This is typical in keyUsage for a client certificate.
	293	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
	294
	295	# This will be displayed in Netscape's comment listbox.
	296	nsComment = "OpenSSL Generated Certificate"
	297
	298	# PKIX recommendations harmless if included in all certificates.
	299	subjectKeyIdentifier=hash
06ddf8eb	300	authorityKeyIdentifier=keyid,issuer
6951c23a RL	301
	302	# This stuff is for subjectAltName and issuerAltname.
	303	# Import the email address.
	304	# subjectAltName=email:copy
	305	# An alternative to produce certificates that aren't
	306	# deprecated according to PKIX.
	307	# subjectAltName=email:move
	308
	309	# Copy subject details
	310	# issuerAltName=issuer:copy
	311
	312	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
	313	#nsBaseUrl
	314	#nsRevocationUrl
	315	#nsRenewalUrl
	316	#nsCaPolicyUrl
	317	#nsSslServerName
	318
	319	# This really needs to be in place for it to be a proxy certificate.
	320	proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
c7235be6 UM	321
	322	####################################################################
	323	[ tsa ]
	324
	325	default_tsa = tsa_config1 # the default TSA section
	326
	327	[ tsa_config1 ]
	328
	329	# These are used by the TSA reply generation only.
	330	dir = ./demoCA # TSA root directory
	331	serial = $dir/tsaserial # The current serial number (mandatory)
	332	crypto_device = builtin # OpenSSL engine to use for signing
	333	signer_cert = $dir/tsacert.pem # The TSA signing certificate
	334	# (optional)
	335	certs = $dir/cacert.pem # Certificate chain to include in reply
	336	# (optional)
	337	signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
2cc7acd2	338	signer_digest = sha256 # Signing digest to use. (Optional)
c7235be6 UM	339	default_policy = tsa_policy1 # Policy if request did not specify it
	340	# (optional)
	341	other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
2cc7acd2	342	digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory)
c7235be6 UM	343	accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
	344	clock_precision_digits = 0 # number of digits after dot. (optional)
	345	ordering = yes # Is ordering defined for timestamps?
	346	# (optional, default: no)
	347	tsa_name = yes # Must the TSA name be included in the reply?
	348	# (optional, default: no)
	349	ess_cert_id_chain = no # Must the ESS cert id chain be included?
	350	# (optional, default: no)
f0ef20bf MK	351	ess_cert_id_alg = sha1 # algorithm to compute certificate
f0ef20bf MK	352	# identifier (optional, default: sha1)