updated example certtool.cfg

diff --git a/doc/certtool.cfg b/doc/certtool.cfg
index db6ba7067211aba04bb40abe04724fdf8dd79040..47d4d3897f692fdb260a3141ad01a6f0866a7e86 100644 (file)
--- a/doc/certtool.cfg
+++ b/doc/certtool.cfg
@@ -9,7 +9,7 @@ organization = "Koko inc."
 unit = "sleeping dept."
 
 # The locality of the subject.
-# locality = 
+# locality =
 
 # The state of the certificate owner.
 state = "Attiki"
@@ -23,33 +23,67 @@ cn = "Cindy Lauper"
 # A user id of the certificate owner.
 #uid = "clauper"
 
+# Set domain components
+#dc = "name"
+#dc = "domain"
+
 # If the supported DN OIDs are not adequate you can set
 # any OID here.
 # For example set the X.520 Title and the X.520 Pseudonym
 # by using OID and string pairs.
-#dn_oid = "2.5.4.12" "Dr." "2.5.4.65" "jackal" 
+#dn_oid = 2.5.4.12 Dr. 
+#dn_oid = 2.5.4.65 jackal
 
 # This is deprecated and should not be used in new
 # certificates.
-# pkcs9_email = "none@none.org"
+# pkcs9_email = "none@@none.org"
+
+# An alternative way to set the certificate's distinguished name directly
+# is with the "dn" option. The attribute names allowed are:
+# C (country), street, O (organization), OU (unit), title, CN (common name),
+# L (locality), ST (state), placeOfBirth, gender, countryOfCitizenship, 
+# countryOfResidence, serialNumber, telephoneNumber, surName, initials, 
+# generationQualifier, givenName, pseudonym, dnQualifier, postalCode, name, 
+# businessCategory, DC, UID, jurisdictionOfIncorporationLocalityName, 
+# jurisdictionOfIncorporationStateOrProvinceName,
+# jurisdictionOfIncorporationCountryName, XmppAddr, and numeric OIDs.
+
+#dn = "cn=Nik,st=Attiki,C=GR,surName=Mavrogiannopoulos,2.5.4.9=Arkadias"
 
 # The serial number of the certificate
 serial = 007
 
 # In how many days, counting from today, this certificate will expire.
+# Use -1 if there is no expiration date.
 expiration_days = 700
 
+# Alternatively you may set concrete dates and time. The GNU date string 
+# formats are accepted. See:
+# http://www.gnu.org/software/tar/manual/html_node/Date-input-formats.html
+
+#activation_date = "2004-02-29 16:21:42"
+#expiration_date = "2025-02-29 16:24:41"
 
 # X.509 v3 extensions
 
 # A dnsname in case of a WWW server.
 #dns_name = "www.none.org"
+#dns_name = "www.morethanone.org"
+
+# A subject alternative name URI
+#uri = "http://www.example.com"
 
 # An IP address in case of a server.
 #ip_address = "192.168.1.1"
 
 # An email in case of a person
-email = "none@none.org"
+email = "none@@none.org"
+
+# Challenge password used in certificate requests
+challenge_password = 123456
+
+# Password when encrypting a private key
+#password = secret
 
 # An URL that has CRLs (certificate revocation lists)
 # available. Needed in CA certificates.
@@ -58,6 +92,11 @@ email = "none@none.org"
 # Whether this is a CA certificate or not
 #ca
 
+# for microsoft smart card logon
+# key_purpose_oid = 1.3.6.1.4.1.311.20.2.2
+
+### Other predefined key purpose OIDs
+
 # Whether this certificate will be used for a TLS client
 #tls_www_client
 
@@ -71,7 +110,7 @@ signing_key
 # Whether this certificate will be used to encrypt data (needed
 # in TLS RSA ciphersuites). Note that it is preferred to use different
 # keys for encryption and signing.
-#encryption_key
+encryption_key
 
 # Whether this key will be used to sign other certificates.
 #cert_signing_key
@@ -91,27 +130,44 @@ signing_key
 # Whether this key will be used for IPsec IKE operations.
 #ipsec_ike_key
 
-#a space separated list of key purpose OIDs to be added
-#key_purpose_oids = "1.3.6.1.5.5.7.3.1" "1.2.3.4.5.6"
+### end of key purpose OIDs
+
+# When generating a certificate from a certificate
+# request, then honor the extensions stored in the request
+# and store them in the real certificate.
+#honor_crq_extensions
 
-# Things for PKCS #10 certificate Requests
+# Path length contraint. Sets the maximum number of
+# certificates that can be used to certify this certificate.
+# (i.e. the certificate chain length)
+#path_len = -1
+#path_len = 2
 
-# A challenge password for the request.
-#challenge_password = "My challenge password"
+# OCSP URI
+# ocsp_uri = http://my.ocsp.server/ocsp
 
-# When generating certificate use extensions found in certificate request.
-#honor_crq_extensions
+# CA issuers URI
+# ca_issuers_uri = http://my.ca.issuer
+
+# Certificate policies
+# policy1 = 1.3.6.1.4.1.5484.1.10.99.1.0
+# policy1_txt = "This is a long policy to summarize"
+# policy1_url = http://www.example.com/a-policy-to-read
+
+# policy2 = 1.3.6.1.4.1.5484.1.10.99.1.1
+# policy2_txt = "This is a short policy"
+# policy2_url = http://www.example.com/another-policy-to-read
+
+
+# Options for proxy certificates
+# proxy_policy_language = 1.3.6.1.5.5.7.21.1
 
-# Other things.
 
-# A password to be used while encrypting/decrypting.
-#password = "my pass"
+# Options for generating a CRL
 
-# The next update (in days from now) for a CRL
-#crl_next_update = 30
+# next CRL update will be in 43 days (wow)
+#crl_next_update = 43
 
-# The CRL number extension
-#crl_number = 1
+# this is the 5th CRL by this CA
+#crl_number = 5
 
-# A name for a PKCS #12 key
-#pkcs12_key_name = "Anonymous key"