[thirdparty/openssl.git] / apps / openssl-vms.cnf

#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#

# Note that you can include other files from the main configuration
# file using the .include directive.
#.include filename

# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .

# Extra OBJECT IDENTIFIER info:
#oid_file		= $ENV::HOME/.oid
oid_section		= new_oids

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		=
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]

# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7

####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

####################################################################
[ CA_default ]

dir		= sys\$disk:[.demoCA		# Where everything is kept
certs		= $dir.certs]		# Where the issued certs are kept
crl_dir		= $dir.crl]		# Where the issued crl are kept
database	= $dir]index.txt	# database index file.
#unique_subject	= no			# Set to 'no' to allow creation of
					# several certs with same subject.
new_certs_dir	= $dir.newcerts]		# default place for new certs.

certificate	= $dir]cacert.pem 	# The CA certificate
serial		= $dir]serial. 		# The current serial number
crlnumber	= $dir]crlnumber.	# the current crl number
					# must be commented out to leave a V1 CRL
crl		= $dir]crl.pem 		# The current CRL
private_key	= $dir.private]cakey.pem# The private key

x509_extensions	= usr_cert		# The extensions to add to the cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

# Extension copying option: use with caution.
# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions	= crl_ext

default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= default		# use public key default MD
preserve	= no			# keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_match

# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

####################################################################
[ req ]
default_bits		= 2048
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca	# The extensions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= AU
countryName_min			= 2
countryName_max			= 2

stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= Some-State

localityName			= Locality Name (eg, city)

0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= Internet Widgits Pty Ltd

# we can do this but it is not needed normally :-)
#1.organizationName		= Second Organization Name (eg, company)
#1.organizationName_default	= World Wide Web Pty Ltd

organizationalUnitName		= Organizational Unit Name (eg, section)
#organizationalUnitName_default	=

commonName			= Common Name (e.g. server FQDN or YOUR name)
commonName_max			= 64

emailAddress			= Email Address
emailAddress_max		= 64

# SET-ex3			= SET extension number 3

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

unstructuredName		= An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType			= server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment			= "OpenSSL Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

# This is required for TSA certificates.
# extendedKeyUsage = critical,timeStamping

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]


# Extensions for a typical CA


# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer

basicConstraints = critical,CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Some might want this also
# nsCertType = sslCA, emailCA

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always

[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType			= server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment			= "OpenSSL Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

####################################################################
[ tsa ]

default_tsa = tsa_config1	# the default TSA section

[ tsa_config1 ]

# These are used by the TSA reply generation only.
dir		= sys\$disk:[.demoCA		# TSA root directory
serial		= $dir]tsaserial.	# The current serial number (mandatory)
crypto_device	= builtin		# OpenSSL engine to use for signing
signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
					# (optional)
certs		= $dir.cacert.pem]	# Certificate chain to include in reply
					# (optional)
signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
signer_digest  = sha256			# Signing digest to use. (Optional)
default_policy	= tsa_policy1		# Policy if request did not specify it
					# (optional)
other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
digests     = sha1, sha256, sha384, sha512  # Acceptable message digests (mandatory)
accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
clock_precision_digits  = 0	# number of digits after dot. (optional)
ordering		= yes	# Is ordering defined for timestamps?
				# (optional, default: no)
tsa_name		= yes	# Must the TSA name be included in the reply?
				# (optional, default: no)
ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
				# (optional, default: no)
ess_cert_id_alg		= sha1	# algorithm to compute certificate
				# identifier (optional, default: sha1)
Commit	Line	Data
7d7d2cbc UM	1	#
	2	# OpenSSL example configuration file.
	3	# This is mostly being used for generation of certificate requests.
	4	#
	5
b524b808 TM	6	# Note that you can include other files from the main configuration
	7	# file using the .include directive.
	8	#.include filename
	9
d1739eb2 RL	10	# This definition stops the following lines choking if HOME isn't
	11	# defined.
	12	HOME = .
d1739eb2 RL	13
	14	# Extra OBJECT IDENTIFIER info:
	15	#oid_file = $ENV::HOME/.oid
7d7d2cbc UM	16	oid_section = new_oids
7d7d2cbc UM	17
9dff4cc0 UM	18	# To use this configuration file with the "-extfile" option of the
	19	# "openssl x509" utility, name here the section containing the
	20	# X.509v3 extensions to use:
df443918	21	# extensions =
9dff4cc0 UM	22	# (Alternatively, use a configuration file that has only
	23	# X.509v3 extensions in its main [= default] section.)
	24
7d7d2cbc UM	25	[ new_oids ]
7d7d2cbc UM	26
c7235be6	27	# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
7d7d2cbc UM	28	# Add a simple OID like this:
	29	# testoid1=1.2.3.4
	30	# Or use config file substitution like this:
	31	# testoid2=${testoid1}.5.6
	32
c7235be6 UM	33	# Policies used by the TSA examples.
	34	tsa_policy1 = 1.2.3.4.1
	35	tsa_policy2 = 1.2.3.4.5.6
	36	tsa_policy3 = 1.2.3.4.5.7
	37
7d7d2cbc UM	38	####################################################################
	39	[ ca ]
	40	default_ca = CA_default # The default ca section
	41
	42	####################################################################
	43	[ CA_default ]
	44
d1739eb2	45	dir = sys\$disk:[.demoCA # Where everything is kept
7d7d2cbc UM	46	certs = $dir.certs] # Where the issued certs are kept
	47	crl_dir = $dir.crl] # Where the issued crl are kept
	48	database = $dir]index.txt # database index file.
d1739eb2	49	#unique_subject = no # Set to 'no' to allow creation of
455b65df	50	# several certs with same subject.
d1739eb2	51	new_certs_dir = $dir.newcerts] # default place for new certs.
7d7d2cbc UM	52
7d7d2cbc UM	53	certificate = $dir]cacert.pem # The CA certificate
d1739eb2 RL	54	serial = $dir]serial. # The current serial number
	55	crlnumber = $dir]crlnumber. # the current crl number
	56	# must be commented out to leave a V1 CRL
7d7d2cbc UM	57	crl = $dir]crl.pem # The current CRL
7d7d2cbc UM	58	private_key = $dir.private]cakey.pem# The private key
7d7d2cbc	59
478b50cf	60	x509_extensions = usr_cert # The extensions to add to the cert
9dff4cc0	61
d1739eb2 RL	62	# Comment out the following two lines for the "traditional"
	63	# (and highly broken) format.
	64	name_opt = ca_default # Subject Name options
	65	cert_opt = ca_default # Certificate field options
	66
	67	# Extension copying option: use with caution.
	68	# copy_extensions = copy
	69
9dff4cc0 UM	70	# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
9dff4cc0 UM	71	# so this is commented out by default to leave a V1 CRL.
d1739eb2	72	# crlnumber must also be commented out to leave a V1 CRL.
9dff4cc0 UM	73	# crl_extensions = crl_ext
9dff4cc0 UM	74
7d7d2cbc UM	75	default_days = 365 # how long to certify for
7d7d2cbc UM	76	default_crl_days= 30 # how long before next CRL
98bf13c3	77	default_md = default # use public key default MD
7d7d2cbc UM	78	preserve = no # keep passed DN ordering
	79
	80	# A few difference way of specifying how similar the request should look
	81	# For type CA, the listed attributes must be the same, and the optional
	82	# and supplied fields are just that :-)
	83	policy = policy_match
	84
	85	# For the CA policy
	86	[ policy_match ]
	87	countryName = match
	88	stateOrProvinceName = match
	89	organizationName = match
	90	organizationalUnitName = optional
	91	commonName = supplied
	92	emailAddress = optional
	93
	94	# For the 'anything' policy
	95	# At this point in time, you must list all acceptable 'object'
	96	# types.
	97	[ policy_anything ]
	98	countryName = optional
	99	stateOrProvinceName = optional
	100	localityName = optional
	101	organizationName = optional
	102	organizationalUnitName = optional
	103	commonName = supplied
	104	emailAddress = optional
	105
	106	####################################################################
	107	[ req ]
455b65df	108	default_bits = 2048
7d7d2cbc UM	109	default_keyfile = privkey.pem
	110	distinguished_name = req_distinguished_name
	111	attributes = req_attributes
478b50cf	112	x509_extensions = v3_ca # The extensions to add to the self signed cert
7d7d2cbc	113
d1739eb2 RL	114	# Passwords for private keys if not present they will be prompted for
	115	# input_password = secret
	116	# output_password = secret
	117
df443918	118	# This sets a mask for permitted string types. There are several options.
849c0fe2	119	# default: PrintableString, T61String, BMPString.
9ab899a6 RL	120	# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
9ab899a6 RL	121	# utf8only: only UTF8Strings (PKIX recommendation after 2004).
d1739eb2	122	# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
849c0fe2	123	# MASK:XXXX a literal mask value.
9ab899a6 RL	124	# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
9ab899a6 RL	125	string_mask = utf8only
849c0fe2 RL	126
	127	# req_extensions = v3_req # The extensions to add to a certificate request
	128
7d7d2cbc UM	129	[ req_distinguished_name ]
	130	countryName = Country Name (2 letter code)
	131	countryName_default = AU
	132	countryName_min = 2
	133	countryName_max = 2
	134
	135	stateOrProvinceName = State or Province Name (full name)
	136	stateOrProvinceName_default = Some-State
	137
	138	localityName = Locality Name (eg, city)
	139
	140	0.organizationName = Organization Name (eg, company)
	141	0.organizationName_default = Internet Widgits Pty Ltd
	142
	143	# we can do this but it is not needed normally :-)
	144	#1.organizationName = Second Organization Name (eg, company)
	145	#1.organizationName_default = World Wide Web Pty Ltd
	146
	147	organizationalUnitName = Organizational Unit Name (eg, section)
	148	#organizationalUnitName_default =
	149
84b6e277	150	commonName = Common Name (e.g. server FQDN or YOUR name)
7d7d2cbc UM	151	commonName_max = 64
	152
	153	emailAddress = Email Address
d1739eb2	154	emailAddress_max = 64
7d7d2cbc UM	155
	156	# SET-ex3 = SET extension number 3
	157
	158	[ req_attributes ]
	159	challengePassword = A challenge password
	160	challengePassword_min = 4
	161	challengePassword_max = 20
	162
	163	unstructuredName = An optional company name
	164
	165	[ usr_cert ]
	166
	167	# These extensions are added when 'ca' signs a request.
	168
	169	# This goes against PKIX guidelines but some CAs do it and some software
	170	# requires this to avoid interpreting an end user certificate as a CA.
	171
	172	basicConstraints=CA:FALSE
	173
	174	# Here are some examples of the usage of nsCertType. If it is omitted
	175	# the certificate can be used for anything except object signing.
	176
	177	# This is OK for an SSL server.
9dff4cc0	178	# nsCertType = server
7d7d2cbc UM	179
7d7d2cbc UM	180	# For an object signing certificate this would be used.
9dff4cc0	181	# nsCertType = objsign
7d7d2cbc UM	182
7d7d2cbc UM	183	# For normal client use this is typical
9dff4cc0	184	# nsCertType = client, email
7d7d2cbc	185
9dff4cc0 UM	186	# and for everything including object signing:
9dff4cc0 UM	187	# nsCertType = client, email, objsign
7d7d2cbc	188
9dff4cc0 UM	189	# This is typical in keyUsage for a client certificate.
9dff4cc0 UM	190	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
7d7d2cbc	191
9dff4cc0	192	# This will be displayed in Netscape's comment listbox.
7d7d2cbc UM	193	nsComment = "OpenSSL Generated Certificate"
7d7d2cbc UM	194
9dff4cc0	195	# PKIX recommendations harmless if included in all certificates.
7d7d2cbc	196	subjectKeyIdentifier=hash
c7235be6	197	authorityKeyIdentifier=keyid,issuer
7d7d2cbc	198
9dff4cc0	199	# This stuff is for subjectAltName and issuerAltname.
7d7d2cbc	200	# Import the email address.
9dff4cc0	201	# subjectAltName=email:copy
d1739eb2 RL	202	# An alternative to produce certificates that aren't
	203	# deprecated according to PKIX.
	204	# subjectAltName=email:move
7d7d2cbc UM	205
7d7d2cbc UM	206	# Copy subject details
9dff4cc0	207	# issuerAltName=issuer:copy
7d7d2cbc UM	208
	209	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
	210	#nsBaseUrl
	211	#nsRevocationUrl
	212	#nsRenewalUrl
	213	#nsCaPolicyUrl
	214	#nsSslServerName
	215
c7235be6	216	# This is required for TSA certificates.
96afc1cf	217	# extendedKeyUsage = critical,timeStamping
c7235be6	218
849c0fe2 RL	219	[ v3_req ]
	220
	221	# Extensions to add to a certificate request
	222
	223	basicConstraints = CA:FALSE
	224	keyUsage = nonRepudiation, digitalSignature, keyEncipherment
	225
	226	[ v3_ca ]
	227
7d7d2cbc UM	228
	229	# Extensions for a typical CA
	230
7d7d2cbc UM	231
	232	# PKIX recommendation.
	233
	234	subjectKeyIdentifier=hash
	235
ef236ec3	236	authorityKeyIdentifier=keyid:always,issuer
7d7d2cbc	237
a7be5759	238	basicConstraints = critical,CA:true
7d7d2cbc	239
9dff4cc0 UM	240	# Key usage: this is typical for a CA certificate. However since it will
	241	# prevent it being used as an test self-signed certificate it is best
	242	# left out by default.
	243	# keyUsage = cRLSign, keyCertSign
7d7d2cbc UM	244
7d7d2cbc UM	245	# Some might want this also
9dff4cc0	246	# nsCertType = sslCA, emailCA
7d7d2cbc UM	247
7d7d2cbc UM	248	# Include email address in subject alt name: another PKIX recommendation
9dff4cc0	249	# subjectAltName=email:copy
7d7d2cbc	250	# Copy issuer details
9dff4cc0	251	# issuerAltName=issuer:copy
7d7d2cbc	252
849c0fe2 RL	253	# DER hex encoding of an extension: beware experts only!
	254	# obj=DER:02:03
	255	# Where 'obj' is a standard or added object
7d7d2cbc	256	# You can even override a supported extension:
849c0fe2	257	# basicConstraints= critical, DER:30:03:01:01:FF
9dff4cc0 UM	258
	259	[ crl_ext ]
	260
	261	# CRL extensions.
	262	# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
	263
	264	# issuerAltName=issuer:copy
ef236ec3	265	authorityKeyIdentifier=keyid:always
6951c23a RL	266
	267	[ proxy_cert_ext ]
	268	# These extensions should be added when creating a proxy certificate
	269
	270	# This goes against PKIX guidelines but some CAs do it and some software
	271	# requires this to avoid interpreting an end user certificate as a CA.
	272
	273	basicConstraints=CA:FALSE
	274
	275	# Here are some examples of the usage of nsCertType. If it is omitted
	276	# the certificate can be used for anything except object signing.
	277
	278	# This is OK for an SSL server.
	279	# nsCertType = server
	280
	281	# For an object signing certificate this would be used.
	282	# nsCertType = objsign
	283
	284	# For normal client use this is typical
	285	# nsCertType = client, email
	286
	287	# and for everything including object signing:
	288	# nsCertType = client, email, objsign
	289
	290	# This is typical in keyUsage for a client certificate.
	291	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
	292
	293	# This will be displayed in Netscape's comment listbox.
	294	nsComment = "OpenSSL Generated Certificate"
	295
	296	# PKIX recommendations harmless if included in all certificates.
	297	subjectKeyIdentifier=hash
ef236ec3	298	authorityKeyIdentifier=keyid,issuer
6951c23a RL	299
	300	# This stuff is for subjectAltName and issuerAltname.
	301	# Import the email address.
	302	# subjectAltName=email:copy
	303	# An alternative to produce certificates that aren't
	304	# deprecated according to PKIX.
	305	# subjectAltName=email:move
	306
	307	# Copy subject details
	308	# issuerAltName=issuer:copy
	309
	310	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
	311	#nsBaseUrl
	312	#nsRevocationUrl
	313	#nsRenewalUrl
	314	#nsCaPolicyUrl
	315	#nsSslServerName
	316
	317	# This really needs to be in place for it to be a proxy certificate.
	318	proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
c7235be6 UM	319
	320	####################################################################
	321	[ tsa ]
	322
	323	default_tsa = tsa_config1 # the default TSA section
	324
	325	[ tsa_config1 ]
	326
	327	# These are used by the TSA reply generation only.
	328	dir = sys\$disk:[.demoCA # TSA root directory
	329	serial = $dir]tsaserial. # The current serial number (mandatory)
	330	crypto_device = builtin # OpenSSL engine to use for signing
	331	signer_cert = $dir/tsacert.pem # The TSA signing certificate
	332	# (optional)
	333	certs = $dir.cacert.pem] # Certificate chain to include in reply
	334	# (optional)
	335	signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
39a6a4a7	336	signer_digest = sha256 # Signing digest to use. (Optional)
c7235be6 UM	337	default_policy = tsa_policy1 # Policy if request did not specify it
	338	# (optional)
	339	other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
2cc7acd2	340	digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory)
c7235be6 UM	341	accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
	342	clock_precision_digits = 0 # number of digits after dot. (optional)
	343	ordering = yes # Is ordering defined for timestamps?
	344	# (optional, default: no)
	345	tsa_name = yes # Must the TSA name be included in the reply?
	346	# (optional, default: no)
	347	ess_cert_id_chain = no # Must the ESS cert id chain be included?
	348	# (optional, default: no)
f0ef20bf MK	349	ess_cert_id_alg = sha1 # algorithm to compute certificate
f0ef20bf MK	350	# identifier (optional, default: sha1)