221 lines
5.8 KiB
INI
221 lines
5.8 KiB
INI
#
|
|
# sscep.conf -- configuration file for SSCEP
|
|
#
|
|
# All configuration options are key-value pairs, grouped into sections:
|
|
#
|
|
# [section]
|
|
# Key = Value
|
|
#
|
|
# Quotation marks are optional - they are needed only if the value contains
|
|
# space characters (space or tab). Quotation marks inside the value string
|
|
# must be escaped using a backslash:
|
|
#
|
|
# Key = "Value \"containing quotation marks\""
|
|
#
|
|
# Comment lines (lines starting with '#') and empty lines are discarded.
|
|
#
|
|
|
|
# sscep is the default section. Do not alter its name
|
|
[sscep]
|
|
|
|
# Reference to an engine definition section (see below)
|
|
# Uncomment to use the defined engine instead of the filesystem.
|
|
# engine = sscep_engine
|
|
|
|
# SCEP server URL
|
|
#URL = http://localhost/scep
|
|
URL = http://pki.secmayl.com/scep
|
|
|
|
# Use proxy server at host:port
|
|
#Proxy = localhost:8080
|
|
|
|
# CA certificate file (write if OPERATION is getca)
|
|
#CACertFile = ca.crt
|
|
CACertFile = ca.pem
|
|
|
|
# PKCS#7 encryption algorithm (des|3des|blowfish|aes[128]|aes192|aes256)
|
|
#EncAlgorithm = 3des
|
|
EncAlgorithm = aes256
|
|
|
|
# PKCS#7 signature algorithm (md5|sha1|sha224|sha256|sha384|sha512)
|
|
# SigAlgorithm = sha1
|
|
SigAlgorithm = sha256
|
|
|
|
# Note: this could be very misleading, the SCEP standard provides no
|
|
# mechanism to "negotiate" the algorithm - even if you send 3des, reply
|
|
# might be des.
|
|
|
|
# Verbose operation (true|false)
|
|
Verbose = false
|
|
|
|
# Debug (even more verbose operation)
|
|
Debug = false
|
|
|
|
|
|
[sscep_engine]
|
|
# Engine definition. It can have any name, as long as the name is referenced
|
|
# by the "engine" option in the [sscep] section.
|
|
# The parameter engine_id is mandatory.
|
|
|
|
# Engine ID. The engine will use the OpenSSL's engine interface.
|
|
# Supported engines are:
|
|
# - Any installed OpenSSL engine (e.g. tpm2tss)
|
|
# - capi (Microsoft CryptoAPI)
|
|
# - dynamic (loaded via dynamic_path)
|
|
# engine_id = capi
|
|
|
|
# If the engine needs to be loaded dynamically, specify the path to the SO file here.
|
|
# It is possible to provide paths relative to the sscep binary
|
|
# Note: On Windows use double slashes, see example
|
|
# Note: You HAVE to specify this unless you *know* it will be found otherwise. On
|
|
# Windows this can lead to problems since OpenSSL is often compiled with a Unix-
|
|
# Search-Path. In this case this can't be omitted at all.
|
|
# dynamic_path = ..\\capi\\capi.dll
|
|
|
|
# Some Engines require an additional module (take PKCS#11 interface for example)
|
|
# For these engines you can specify an additional module path here
|
|
# Note: On Windows use double slashes, see "dynamic_path" option
|
|
# MODULE_PATH =
|
|
|
|
# Special Options for engines are defined in their corresponding
|
|
# sections, always named [sscep_engine_*] where * is the defined
|
|
# engine id. You can see currently supported special options in
|
|
# each of these sections. If a section does not exist, it does
|
|
# not mean the engine is not supported, there are just no special
|
|
# options avaiable for it.
|
|
|
|
|
|
[sscep_engine_capi]
|
|
# This section defines CryptoAPI specific settings
|
|
# Only if the [engine]-section's engine_id is set to capi, this will be loaded,
|
|
# otherwise it will be ignored.
|
|
|
|
# Specific CryptoAPI option: Set this option to whatever
|
|
# location your newly generated key will reside in.
|
|
# In case of certreq creating your key, it will be in REQUEST.
|
|
new_key_location = REQUEST
|
|
|
|
# Which store should be used for all operations.
|
|
# The basic layout is storelocation\storename, e.g.
|
|
# LOCAL_MACHINE\MY and LOCAL_MACHINE\REQUEST
|
|
# The following options are accepted here:
|
|
# CURRENT_USER - default option, user store
|
|
# LOCAL_MACHINE - system store
|
|
storelocation = LOCAL_MACHINE
|
|
|
|
|
|
[sscep_engine_jksengine]
|
|
# This section defines JKSEngine specific settings
|
|
# Only if engine_id is set to "JKSEngine" this will be loaded, otherwise ignored.
|
|
|
|
# Password of Java KeyStore (Default: 123456)
|
|
# See JKSEngine for further documentation
|
|
# KeyStorePass =
|
|
|
|
# Path of Java tool (Path to ConnJKSEngine)
|
|
# JavaConnectorPath =
|
|
|
|
# Java Cryptography Provider of used Keystore
|
|
# KeyStoreProvider =
|
|
|
|
# Path of Java Runtime Environment
|
|
# This is normally not necessary
|
|
# JavaPath =
|
|
|
|
|
|
[sscep_getca]
|
|
# Options for retrieving CA Certificates (operation getca)
|
|
|
|
# CA certificate file (write if OPERATION is getca)
|
|
#CACertFile = ca.crt
|
|
CACertFile = ca.pem
|
|
|
|
# CA identifier string, required by some CA
|
|
#CAIdentifier = "CA Identifier"
|
|
|
|
# Fingerprint algorithm (md5|sha1|sha224|sha256|sha384|sha512)
|
|
#FingerPrint = md5
|
|
FingerPrint = sha1
|
|
|
|
|
|
[sscep_enroll]
|
|
# Operation for Certificate Enrollment (see SCEP documentation for details)
|
|
|
|
# CA certificate file
|
|
#CACertFile = ca.crt
|
|
CACertFile = ca.pem
|
|
|
|
# Private key file
|
|
#PrivateKeyFile = local.key
|
|
PrivateKeyFile = key.pem
|
|
|
|
# Certificate request file
|
|
#CertReqFile = local.csr
|
|
CertReqFile = csr.pem
|
|
|
|
# Signature private key file, use with SignCertFile
|
|
#SignKeyFile = previous.key
|
|
SignKeyFile = prev/key.pem
|
|
|
|
# Signature certificate (used instead of self-signed)
|
|
#SignCertFile = previous.crt
|
|
SignCertFile = prev/crt.pem
|
|
|
|
# Write enrolled certificate in file
|
|
#LocalCertFile = local.crt
|
|
LocalCertFile = crt.pem
|
|
|
|
# Use different CA cert for encryption
|
|
#EncCertFile = enc.crt
|
|
|
|
# Write selfsigned certificate in file
|
|
#SelfSignedFile = selfsigned.crt
|
|
|
|
# Polling interval for pending certificate (seconds)
|
|
#PollInterval = 60
|
|
|
|
# Maximum polling time (seconds)
|
|
#MaxPollTime = 28800
|
|
|
|
# Max number of GetCertInitial requests
|
|
#MaxPollCount = 256
|
|
|
|
# Resume interrupted enrollment (true|false)
|
|
#Resume =
|
|
#Resume = true
|
|
|
|
|
|
[sscep_getcert]
|
|
# Private key file
|
|
#PrivateKeyFile = local.key
|
|
PrivateKeyFile = key.pem
|
|
|
|
# Local certificate file
|
|
#LocalCertFile = local.crt
|
|
LocalCertFile = crt.pem
|
|
|
|
# Certificate serial number (decimal)
|
|
#GetCertSerial = 1
|
|
|
|
# Write certificate in file
|
|
#GetCertFile = cert.crt
|
|
GetCertFile = crt.pem
|
|
|
|
|
|
[sscep_getcrl]
|
|
# Private key file
|
|
#PrivateKeyFile = local.key
|
|
PrivateKeyFile = key.pem
|
|
|
|
# Local certificate file
|
|
#LocalCertFile = local.crt
|
|
LocalCertFile = crt.pem
|
|
|
|
# Write CRL in file
|
|
#GetCrlFile = crl.crl
|
|
GetCrlFile = crl.pem
|
|
|
|
|
|
[sscep_getnextca]
|
|
#NYI
|