[thirdparty/openssl.git] / apps / openssl.cnf

#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#

# Note that you can include other files from the main configuration
# file using the .include directive.
#.include filename

# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .

# Extra OBJECT IDENTIFIER info:
#oid_file		= $ENV::HOME/.oid
oid_section		= new_oids

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		=
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]

# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7

####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

####################################################################
[ CA_default ]

dir		= ./demoCA		# Where everything is kept
certs		= $dir/certs		# Where the issued certs are kept
crl_dir		= $dir/crl		# Where the issued crl are kept
database	= $dir/index.txt	# database index file.
#unique_subject	= no			# Set to 'no' to allow creation of
					# several certs with same subject.
new_certs_dir	= $dir/newcerts		# default place for new certs.

certificate	= $dir/cacert.pem 	# The CA certificate
serial		= $dir/serial 		# The current serial number
crlnumber	= $dir/crlnumber	# the current crl number
					# must be commented out to leave a V1 CRL
crl		= $dir/crl.pem 		# The current CRL
private_key	= $dir/private/cakey.pem# The private key

x509_extensions	= usr_cert		# The extensions to add to the cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

# Extension copying option: use with caution.
# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions	= crl_ext

default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= default		# use public key default MD
preserve	= no			# keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_match

# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

####################################################################
[ req ]
default_bits		= 2048
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca	# The extensions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= AU
countryName_min			= 2
countryName_max			= 2

stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= Some-State

localityName			= Locality Name (eg, city)

0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= Internet Widgits Pty Ltd

# we can do this but it is not needed normally :-)
#1.organizationName		= Second Organization Name (eg, company)
#1.organizationName_default	= World Wide Web Pty Ltd

organizationalUnitName		= Organizational Unit Name (eg, section)
#organizationalUnitName_default	=

commonName			= Common Name (e.g. server FQDN or YOUR name)
commonName_max			= 64

emailAddress			= Email Address
emailAddress_max		= 64

# SET-ex3			= SET extension number 3

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

unstructuredName		= An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType			= server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment			= "OpenSSL Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

# This is required for TSA certificates.
# extendedKeyUsage = critical,timeStamping

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]


# Extensions for a typical CA


# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer

basicConstraints = critical,CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Some might want this also
# nsCertType = sslCA, emailCA

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always

[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType			= server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment			= "OpenSSL Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

####################################################################
[ tsa ]

default_tsa = tsa_config1	# the default TSA section

[ tsa_config1 ]

# These are used by the TSA reply generation only.
dir		= ./demoCA		# TSA root directory
serial		= $dir/tsaserial	# The current serial number (mandatory)
crypto_device	= builtin		# OpenSSL engine to use for signing
signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
					# (optional)
certs		= $dir/cacert.pem	# Certificate chain to include in reply
					# (optional)
signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
signer_digest  = sha256			# Signing digest to use. (Optional)
default_policy	= tsa_policy1		# Policy if request did not specify it
					# (optional)
other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
digests     = sha1, sha256, sha384, sha512  # Acceptable message digests (mandatory)
accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
clock_precision_digits  = 0	# number of digits after dot. (optional)
ordering		= yes	# Is ordering defined for timestamps?
				# (optional, default: no)
tsa_name		= yes	# Must the TSA name be included in the reply?
				# (optional, default: no)
ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
				# (optional, default: no)
ess_cert_id_alg		= sha1	# algorithm to compute certificate
				# identifier (optional, default: sha1)
Commit	Line	Data
d02b48c6	1	#
06d5b162	2	# OpenSSL example configuration file.
d02b48c6 RE	3	# This is mostly being used for generation of certificate requests.
	4	#
	5
b524b808 TM	6	# Note that you can include other files from the main configuration
	7	# file using the .include directive.
	8	#.include filename
	9
36217a94 DSH	10	# This definition stops the following lines choking if HOME isn't
	11	# defined.
	12	HOME = .
20432eae DSH	13
	14	# Extra OBJECT IDENTIFIER info:
	15	#oid_file = $ENV::HOME/.oid
a43aa73e DSH	16	oid_section = new_oids
a43aa73e DSH	17
3f45ed82	18	# To use this configuration file with the "-extfile" option of the
e186bf96 BM	19	# "openssl x509" utility, name here the section containing the
e186bf96 BM	20	# X.509v3 extensions to use:
df443918	21	# extensions =
e186bf96 BM	22	# (Alternatively, use a configuration file that has only
	23	# X.509v3 extensions in its main [= default] section.)
	24
a43aa73e DSH	25	[ new_oids ]
a43aa73e DSH	26
c7235be6	27	# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
a43aa73e DSH	28	# Add a simple OID like this:
	29	# testoid1=1.2.3.4
	30	# Or use config file substitution like this:
	31	# testoid2=${testoid1}.5.6
d02b48c6	32
c7235be6 UM	33	# Policies used by the TSA examples.
	34	tsa_policy1 = 1.2.3.4.1
	35	tsa_policy2 = 1.2.3.4.5.6
	36	tsa_policy3 = 1.2.3.4.5.7
	37
d02b48c6 RE	38	####################################################################
	39	[ ca ]
	40	default_ca = CA_default # The default ca section
	41
	42	####################################################################
	43	[ CA_default ]
	44
	45	dir = ./demoCA # Where everything is kept
	46	certs = $dir/certs # Where the issued certs are kept
	47	crl_dir = $dir/crl # Where the issued crl are kept
	48	database = $dir/index.txt # database index file.
f85b68cd	49	#unique_subject = no # Set to 'no' to allow creation of
a5a31787	50	# several certs with same subject.
d02b48c6 RE	51	new_certs_dir = $dir/newcerts # default place for new certs.
	52
	53	certificate = $dir/cacert.pem # The CA certificate
	54	serial = $dir/serial # The current serial number
fd4ef699 RL	55	crlnumber = $dir/crlnumber # the current crl number
fd4ef699 RL	56	# must be commented out to leave a V1 CRL
d02b48c6 RE	57	crl = $dir/crl.pem # The current CRL
d02b48c6 RE	58	private_key = $dir/private/cakey.pem# The private key
d02b48c6	59
478b50cf	60	x509_extensions = usr_cert # The extensions to add to the cert
257e206d	61
e890dcdb DSH	62	# Comment out the following two lines for the "traditional"
	63	# (and highly broken) format.
	64	name_opt = ca_default # Subject Name options
	65	cert_opt = ca_default # Certificate field options
	66
791bd0cd DSH	67	# Extension copying option: use with caution.
	68	# copy_extensions = copy
	69
257e206d DSH	70	# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
257e206d DSH	71	# so this is commented out by default to leave a V1 CRL.
fd4ef699	72	# crlnumber must also be commented out to leave a V1 CRL.
257e206d DSH	73	# crl_extensions = crl_ext
257e206d DSH	74
d02b48c6 RE	75	default_days = 365 # how long to certify for
d02b48c6 RE	76	default_crl_days= 30 # how long before next CRL
03919683	77	default_md = default # use public key default MD
d02b48c6 RE	78	preserve = no # keep passed DN ordering
	79
	80	# A few difference way of specifying how similar the request should look
	81	# For type CA, the listed attributes must be the same, and the optional
	82	# and supplied fields are just that :-)
	83	policy = policy_match
	84
	85	# For the CA policy
	86	[ policy_match ]
	87	countryName = match
	88	stateOrProvinceName = match
	89	organizationName = match
	90	organizationalUnitName = optional
	91	commonName = supplied
	92	emailAddress = optional
	93
	94	# For the 'anything' policy
	95	# At this point in time, you must list all acceptable 'object'
	96	# types.
	97	[ policy_anything ]
	98	countryName = optional
	99	stateOrProvinceName = optional
	100	localityName = optional
	101	organizationName = optional
	102	organizationalUnitName = optional
	103	commonName = supplied
	104	emailAddress = optional
	105
	106	####################################################################
	107	[ req ]
44e0c2ba	108	default_bits = 2048
d02b48c6 RE	109	default_keyfile = privkey.pem
	110	distinguished_name = req_distinguished_name
	111	attributes = req_attributes
478b50cf	112	x509_extensions = v3_ca # The extensions to add to the self signed cert
d02b48c6	113
36217a94 DSH	114	# Passwords for private keys if not present they will be prompted for
	115	# input_password = secret
	116	# output_password = secret
	117
df443918	118	# This sets a mask for permitted string types. There are several options.
74400f73	119	# default: PrintableString, T61String, BMPString.
29b9763d DSH	120	# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
29b9763d DSH	121	# utf8only: only UTF8Strings (PKIX recommendation after 2004).
b38f9f66	122	# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
74400f73	123	# MASK:XXXX a literal mask value.
29b9763d DSH	124	# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
29b9763d DSH	125	string_mask = utf8only
74400f73	126
c79b16e1 DSH	127	# req_extensions = v3_req # The extensions to add to a certificate request
c79b16e1 DSH	128
d02b48c6 RE	129	[ req_distinguished_name ]
	130	countryName = Country Name (2 letter code)
	131	countryName_default = AU
	132	countryName_min = 2
	133	countryName_max = 2
	134
	135	stateOrProvinceName = State or Province Name (full name)
	136	stateOrProvinceName_default = Some-State
	137
	138	localityName = Locality Name (eg, city)
	139
	140	0.organizationName = Organization Name (eg, company)
	141	0.organizationName_default = Internet Widgits Pty Ltd
	142
	143	# we can do this but it is not needed normally :-)
	144	#1.organizationName = Second Organization Name (eg, company)
06d5b162	145	#1.organizationName_default = World Wide Web Pty Ltd
d02b48c6 RE	146
	147	organizationalUnitName = Organizational Unit Name (eg, section)
	148	#organizationalUnitName_default =
	149
df0cdf4c	150	commonName = Common Name (e.g. server FQDN or YOUR name)
d02b48c6 RE	151	commonName_max = 64
	152
	153	emailAddress = Email Address
d8c2adae	154	emailAddress_max = 64
d02b48c6	155
a43aa73e	156	# SET-ex3 = SET extension number 3
dfeab068	157
d02b48c6 RE	158	[ req_attributes ]
	159	challengePassword = A challenge password
	160	challengePassword_min = 4
	161	challengePassword_max = 20
	162
	163	unstructuredName = An optional company name
	164
b2347661	165	[ usr_cert ]
d02b48c6	166
b2347661	167	# These extensions are added when 'ca' signs a request.
d02b48c6	168
b2347661 DSH	169	# This goes against PKIX guidelines but some CAs do it and some software
b2347661 DSH	170	# requires this to avoid interpreting an end user certificate as a CA.
d02b48c6	171
b2347661 DSH	172	basicConstraints=CA:FALSE
	173
	174	# Here are some examples of the usage of nsCertType. If it is omitted
	175	# the certificate can be used for anything except object signing.
	176
	177	# This is OK for an SSL server.
257e206d	178	# nsCertType = server
b2347661 DSH	179
b2347661 DSH	180	# For an object signing certificate this would be used.
257e206d	181	# nsCertType = objsign
b2347661 DSH	182
b2347661 DSH	183	# For normal client use this is typical
257e206d	184	# nsCertType = client, email
b2347661	185
257e206d DSH	186	# and for everything including object signing:
257e206d DSH	187	# nsCertType = client, email, objsign
b2347661	188
257e206d DSH	189	# This is typical in keyUsage for a client certificate.
257e206d DSH	190	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
b2347661	191
257e206d	192	# This will be displayed in Netscape's comment listbox.
b2347661	193	nsComment = "OpenSSL Generated Certificate"
0be9747b	194
257e206d	195	# PKIX recommendations harmless if included in all certificates.
175b0942	196	subjectKeyIdentifier=hash
29b9763d	197	authorityKeyIdentifier=keyid,issuer
0be9747b	198
257e206d	199	# This stuff is for subjectAltName and issuerAltname.
aa066b9e	200	# Import the email address.
257e206d	201	# subjectAltName=email:copy
ed2e24d5 RL	202	# An alternative to produce certificates that aren't
	203	# deprecated according to PKIX.
	204	# subjectAltName=email:move
aa066b9e DSH	205
aa066b9e DSH	206	# Copy subject details
257e206d	207	# issuerAltName=issuer:copy
b2347661 DSH	208
b2347661 DSH	209	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
d02b48c6 RE	210	#nsBaseUrl
	211	#nsRevocationUrl
	212	#nsRenewalUrl
	213	#nsCaPolicyUrl
	214	#nsSslServerName
d02b48c6	215
c7235be6	216	# This is required for TSA certificates.
54565832	217	# extendedKeyUsage = critical,timeStamping
c7235be6	218
c79b16e1 DSH	219	[ v3_req ]
	220
	221	# Extensions to add to a certificate request
	222
	223	basicConstraints = CA:FALSE
	224	keyUsage = nonRepudiation, digitalSignature, keyEncipherment
	225
5a97a0b6	226	[ v3_ca ]
f317aa4c	227
c79b16e1	228
f317aa4c DSH	229	# Extensions for a typical CA
f317aa4c DSH	230
f317aa4c	231
175b0942 DSH	232	# PKIX recommendation.
	233
	234	subjectKeyIdentifier=hash
	235
06ddf8eb	236	authorityKeyIdentifier=keyid:always,issuer
0be9747b	237
a7be5759	238	basicConstraints = critical,CA:true
b2347661	239
257e206d DSH	240	# Key usage: this is typical for a CA certificate. However since it will
	241	# prevent it being used as an test self-signed certificate it is best
	242	# left out by default.
	243	# keyUsage = cRLSign, keyCertSign
f317aa4c	244
b2347661	245	# Some might want this also
257e206d	246	# nsCertType = sslCA, emailCA
388ff0b0	247
aa066b9e	248	# Include email address in subject alt name: another PKIX recommendation
257e206d	249	# subjectAltName=email:copy
aa066b9e	250	# Copy issuer details
257e206d	251	# issuerAltName=issuer:copy
aa066b9e	252
c79b16e1 DSH	253	# DER hex encoding of an extension: beware experts only!
	254	# obj=DER:02:03
	255	# Where 'obj' is a standard or added object
388ff0b0	256	# You can even override a supported extension:
c79b16e1	257	# basicConstraints= critical, DER:30:03:01:01:FF
1756d405 DSH	258
	259	[ crl_ext ]
	260
	261	# CRL extensions.
	262	# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
	263
257e206d	264	# issuerAltName=issuer:copy
06ddf8eb	265	authorityKeyIdentifier=keyid:always
6951c23a RL	266
	267	[ proxy_cert_ext ]
	268	# These extensions should be added when creating a proxy certificate
	269
	270	# This goes against PKIX guidelines but some CAs do it and some software
	271	# requires this to avoid interpreting an end user certificate as a CA.
	272
	273	basicConstraints=CA:FALSE
	274
	275	# Here are some examples of the usage of nsCertType. If it is omitted
	276	# the certificate can be used for anything except object signing.
	277
	278	# This is OK for an SSL server.
	279	# nsCertType = server
	280
	281	# For an object signing certificate this would be used.
	282	# nsCertType = objsign
	283
	284	# For normal client use this is typical
	285	# nsCertType = client, email
	286
	287	# and for everything including object signing:
	288	# nsCertType = client, email, objsign
	289
	290	# This is typical in keyUsage for a client certificate.
	291	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
	292
	293	# This will be displayed in Netscape's comment listbox.
	294	nsComment = "OpenSSL Generated Certificate"
	295
	296	# PKIX recommendations harmless if included in all certificates.
	297	subjectKeyIdentifier=hash
06ddf8eb	298	authorityKeyIdentifier=keyid,issuer
6951c23a RL	299
	300	# This stuff is for subjectAltName and issuerAltname.
	301	# Import the email address.
	302	# subjectAltName=email:copy
	303	# An alternative to produce certificates that aren't
	304	# deprecated according to PKIX.
	305	# subjectAltName=email:move
	306
	307	# Copy subject details
	308	# issuerAltName=issuer:copy
	309
	310	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
	311	#nsBaseUrl
	312	#nsRevocationUrl
	313	#nsRenewalUrl
	314	#nsCaPolicyUrl
	315	#nsSslServerName
	316
	317	# This really needs to be in place for it to be a proxy certificate.
	318	proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
c7235be6 UM	319
	320	####################################################################
	321	[ tsa ]
	322
	323	default_tsa = tsa_config1 # the default TSA section
	324
	325	[ tsa_config1 ]
	326
	327	# These are used by the TSA reply generation only.
	328	dir = ./demoCA # TSA root directory
	329	serial = $dir/tsaserial # The current serial number (mandatory)
	330	crypto_device = builtin # OpenSSL engine to use for signing
	331	signer_cert = $dir/tsacert.pem # The TSA signing certificate
	332	# (optional)
	333	certs = $dir/cacert.pem # Certificate chain to include in reply
	334	# (optional)
	335	signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
2cc7acd2	336	signer_digest = sha256 # Signing digest to use. (Optional)
c7235be6 UM	337	default_policy = tsa_policy1 # Policy if request did not specify it
	338	# (optional)
	339	other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
2cc7acd2	340	digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory)
c7235be6 UM	341	accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
	342	clock_precision_digits = 0 # number of digits after dot. (optional)
	343	ordering = yes # Is ordering defined for timestamps?
	344	# (optional, default: no)
	345	tsa_name = yes # Must the TSA name be included in the reply?
	346	# (optional, default: no)
	347	ess_cert_id_chain = no # Must the ESS cert id chain be included?
	348	# (optional, default: no)
f0ef20bf MK	349	ess_cert_id_alg = sha1 # algorithm to compute certificate
f0ef20bf MK	350	# identifier (optional, default: sha1)