1 files changed, 0 insertions, 348 deletions
diff --git a/src/lib/libssl/doc/openssl.cnf b/src/lib/libssl/doc/openssl.cnf
deleted file mode 100644
index db95bb5c18..0000000000
--- a/src/lib/libssl/doc/openssl.cnf
+++ /dev/null
@@ -1,348 +0,0 @@
-#
-# OpenSSL example configuration file.
-# This is mostly being used for generation of certificate requests.
-#
-# This definition stops the following lines choking if HOME isn't
-# defined.
-HOME                    = .
-# Extra OBJECT IDENTIFIER info:
-#oid_file               = $ENV::HOME/.oid
-oid_section             = new_oids
-# To use this configuration file with the "-extfile" option of the
-# "openssl x509" utility, name here the section containing the
-# X.509v3 extensions to use:
-# extensions            =
-# (Alternatively, use a configuration file that has only
-# X.509v3 extensions in its main [= default] section.)
-[ new_oids ]
-# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
-# Add a simple OID like this:
-# testoid1=1.2.3.4
-# Or use config file substitution like this:
-# testoid2=${testoid1}.5.6
-# Policies used by the TSA examples.
-tsa_policy1 = 1.2.3.4.1
-tsa_policy2 = 1.2.3.4.5.6
-tsa_policy3 = 1.2.3.4.5.7
-####################################################################
-[ ca ]
-default_ca      = CA_default            # The default ca section
-####################################################################
-[ CA_default ]
-dir             = ./demoCA              # Where everything is kept
-certs           = $dir/certs            # Where the issued certs are kept
-crl_dir         = $dir/crl              # Where the issued crl are kept
-database        = $dir/index.txt        # database index file.
-#unique_subject = no                    # Set to 'no' to allow creation of
-                                        # several certificates with same subject.
-new_certs_dir   = $dir/newcerts         # default place for new certs.
-certificate     = $dir/cacert.pem       # The CA certificate
-serial          = $dir/serial           # The current serial number
-crlnumber       = $dir/crlnumber        # the current crl number
-                                        # must be commented out to leave a V1 CRL
-crl             = $dir/crl.pem          # The current CRL
-private_key     = $dir/private/cakey.pem# The private key
-x509_extensions = usr_cert              # The extensions to add to the cert
-# Comment out the following two lines for the "traditional"
-# (and highly broken) format.
-name_opt        = ca_default            # Subject Name options
-cert_opt        = ca_default            # Certificate field options
-# Extension copying option: use with caution.
-# copy_extensions = copy
-# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
-# so this is commented out by default to leave a V1 CRL.
-# crlnumber must also be commented out to leave a V1 CRL.
-# crl_extensions        = crl_ext
-default_days    = 365                   # how long to certify for
-default_crl_days= 30                    # how long before next CRL
-default_md      = default               # use public key default MD
-preserve        = no                    # keep passed DN ordering
-# A few difference way of specifying how similar the request should look
-# For type CA, the listed attributes must be the same, and the optional
-# and supplied fields are just that :-)
-policy          = policy_match
-# For the CA policy
-[ policy_match ]
-countryName             = match
-stateOrProvinceName     = match
-organizationName        = match
-organizationalUnitName  = optional
-commonName              = supplied
-emailAddress            = optional
-# For the 'anything' policy
-# At this point in time, you must list all acceptable 'object'
-# types.
-[ policy_anything ]
-countryName             = optional
-stateOrProvinceName     = optional
-localityName            = optional
-organizationName        = optional
-organizationalUnitName  = optional
-commonName              = supplied
-emailAddress            = optional
-####################################################################
-[ req ]
-default_bits            = 1024
-default_keyfile         = privkey.pem
-distinguished_name      = req_distinguished_name
-attributes              = req_attributes
-x509_extensions = v3_ca # The extensions to add to the self signed cert
-# Passwords for private keys if not present they will be prompted for
-# input_password = secret
-# output_password = secret
-# This sets a mask for permitted string types. There are several options.
-# default: PrintableString, T61String, BMPString.
-# pkix   : PrintableString, BMPString (PKIX recommendation before 2004)
-# utf8only: only UTF8Strings (PKIX recommendation after 2004).
-# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
-# MASK:XXXX a literal mask value.
-# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
-string_mask = utf8only
-# req_extensions = v3_req # The extensions to add to a certificate request
-[ req_distinguished_name ]
-countryName                     = Country Name (2 letter code)
-countryName_default             = AU
-countryName_min                 = 2
-countryName_max                 = 2
-stateOrProvinceName             = State or Province Name (full name)
-stateOrProvinceName_default     = Some-State
-localityName                    = Locality Name (eg, city)
-0.organizationName              = Organization Name (eg, company)
-0.organizationName_default      = Internet Widgits Pty Ltd
-# we can do this but it is not needed normally :-)
-#1.organizationName             = Second Organization Name (eg, company)
-#1.organizationName_default     = World Wide Web Pty Ltd
-organizationalUnitName          = Organizational Unit Name (eg, section)
-#organizationalUnitName_default =
-commonName                      = Common Name (e.g. server FQDN or YOUR name)
-commonName_max                  = 64
-emailAddress                    = Email Address
-emailAddress_max                = 64
-# SET-ex3                       = SET extension number 3
-[ req_attributes ]
-challengePassword               = A challenge password
-challengePassword_min           = 4
-challengePassword_max           = 20
-unstructuredName                = An optional company name
-[ usr_cert ]
-# These extensions are added when 'ca' signs a request.
-# This goes against PKIX guidelines but some CAs do it and some software
-# requires this to avoid interpreting an end user certificate as a CA.
-basicConstraints=CA:FALSE
-# Here are some examples of the usage of nsCertType. If it is omitted
-# the certificate can be used for anything *except* object signing.
-# This is OK for an SSL server.
-# nsCertType                    = server
-# For an object signing certificate this would be used.
-# nsCertType = objsign
-# For normal client use this is typical
-# nsCertType = client, email
-# and for everything including object signing:
-# nsCertType = client, email, objsign
-# This is typical in keyUsage for a client certificate.
-# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-# This will be displayed in Netscape's comment listbox.
-nsComment                       = "OpenSSL Generated Certificate"
-# PKIX recommendations harmless if included in all certificates.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer
-# This stuff is for subjectAltName and issuerAltname.
-# Import the email address.
-# subjectAltName=email:copy
-# An alternative to produce certificates that aren't
-# deprecated according to PKIX.
-# subjectAltName=email:move
-# Copy subject details
-# issuerAltName=issuer:copy
-#nsCaRevocationUrl              = http://www.domain.dom/ca-crl.pem
-#nsBaseUrl
-#nsRevocationUrl
-#nsRenewalUrl
-#nsCaPolicyUrl
-#nsSslServerName
-# This is required for TSA certificates.
-# extendedKeyUsage = critical,timeStamping
-[ v3_req ]
-# Extensions to add to a certificate request
-basicConstraints = CA:FALSE
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-[ v3_ca ]
-# Extensions for a typical CA
-# PKIX recommendation.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid:always,issuer
-# This is what PKIX recommends but some broken software chokes on critical
-# extensions.
-#basicConstraints = critical,CA:true
-# So we do this instead.
-basicConstraints = CA:true
-# Key usage: this is typical for a CA certificate. However since it will
-# prevent it being used as an test self-signed certificate it is best
-# left out by default.
-# keyUsage = cRLSign, keyCertSign
-# Some might want this also
-# nsCertType = sslCA, emailCA
-# Include email address in subject alt name: another PKIX recommendation
-# subjectAltName=email:copy
-# Copy issuer details
-# issuerAltName=issuer:copy
-# DER hex encoding of an extension: beware experts only!
-# obj=DER:02:03
-# Where 'obj' is a standard or added object
-# You can even override a supported extension:
-# basicConstraints= critical, DER:30:03:01:01:FF
-[ crl_ext ]
-# CRL extensions.
-# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
-# issuerAltName=issuer:copy
-authorityKeyIdentifier=keyid:always
-[ proxy_cert_ext ]
-# These extensions should be added when creating a proxy certificate
-# This goes against PKIX guidelines but some CAs do it and some software
-# requires this to avoid interpreting an end user certificate as a CA.
-basicConstraints=CA:FALSE
-# Here are some examples of the usage of nsCertType. If it is omitted
-# the certificate can be used for anything *except* object signing.
-# This is OK for an SSL server.
-# nsCertType                    = server
-# For an object signing certificate this would be used.
-# nsCertType = objsign
-# For normal client use this is typical
-# nsCertType = client, email
-# and for everything including object signing:
-# nsCertType = client, email, objsign
-# This is typical in keyUsage for a client certificate.
-# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-# This will be displayed in Netscape's comment listbox.
-nsComment                       = "OpenSSL Generated Certificate"
-# PKIX recommendations harmless if included in all certificates.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer
-# This stuff is for subjectAltName and issuerAltname.
-# Import the email address.
-# subjectAltName=email:copy
-# An alternative to produce certificates that aren't
-# deprecated according to PKIX.
-# subjectAltName=email:move
-# Copy subject details
-# issuerAltName=issuer:copy
-#nsCaRevocationUrl              = http://www.domain.dom/ca-crl.pem
-#nsBaseUrl
-#nsRevocationUrl
-#nsRenewalUrl
-#nsCaPolicyUrl
-#nsSslServerName
-# This really needs to be in place for it to be a proxy certificate.
-proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
-####################################################################
-[ tsa ]
-default_tsa = tsa_config1       # the default TSA section
-[ tsa_config1 ]
-# These are used by the TSA reply generation only.
-dir             = ./demoCA              # TSA root directory
-serial          = $dir/tsaserial        # The current serial number (mandatory)
-crypto_device   = builtin               # OpenSSL engine to use for signing
-signer_cert     = $dir/tsacert.pem      # The TSA signing certificate
-                                        # (optional)
-certs           = $dir/cacert.pem       # Certificate chain to include in reply
-                                        # (optional)
-signer_key      = $dir/private/tsakey.pem # The TSA private key (optional)
-default_policy  = tsa_policy1           # Policy if request did not specify it
-                                        # (optional)
-other_policies  = tsa_policy2, tsa_policy3      # acceptable policies (optional)
-digests         = md5, sha1             # Acceptable message digests (mandatory)
-accuracy        = secs:1, millisecs:500, microsecs:100  # (optional)
-clock_precision_digits  = 0     # number of digits after dot. (optional)
-ordering                = yes   # Is ordering defined for timestamps?
-                                # (optional, default: no)
-tsa_name                = yes   # Must the TSA name be included in the reply?
-                                # (optional, default: no)
-ess_cert_id_chain       = no    # Must the ESS cert id chain be included?
-                                # (optional, default: no)

diff --git a/src/lib/libssl/doc/openssl.cnf b/src/lib/libssl/doc/openssl.cnf deleted file mode 100644 index db95bb5c18..0000000000 --- a/src/lib/libssl/doc/openssl.cnf +++ /dev/null
@@ -1,348 +0,0 @@
1	#
2	# OpenSSL example configuration file.
3	# This is mostly being used for generation of certificate requests.
4	#
5
6	# This definition stops the following lines choking if HOME isn't
7	# defined.
8	HOME = .
9
10	# Extra OBJECT IDENTIFIER info:
11	#oid_file = $ENV::HOME/.oid
12	oid_section = new_oids
13
14	# To use this configuration file with the "-extfile" option of the
15	# "openssl x509" utility, name here the section containing the
16	# X.509v3 extensions to use:
17	# extensions =
18	# (Alternatively, use a configuration file that has only
19	# X.509v3 extensions in its main [= default] section.)
20
21	[ new_oids ]
22
23	# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
24	# Add a simple OID like this:
25	# testoid1=1.2.3.4
26	# Or use config file substitution like this:
27	# testoid2=${testoid1}.5.6
28
29	# Policies used by the TSA examples.
30	tsa_policy1 = 1.2.3.4.1
31	tsa_policy2 = 1.2.3.4.5.6
32	tsa_policy3 = 1.2.3.4.5.7
33
34	####################################################################
35	[ ca ]
36	default_ca = CA_default # The default ca section
37
38	####################################################################
39	[ CA_default ]
40
41	dir = ./demoCA # Where everything is kept
42	certs = $dir/certs # Where the issued certs are kept
43	crl_dir = $dir/crl # Where the issued crl are kept
44	database = $dir/index.txt # database index file.
45	#unique_subject = no # Set to 'no' to allow creation of
46	# several certificates with same subject.
47	new_certs_dir = $dir/newcerts # default place for new certs.
48
49	certificate = $dir/cacert.pem # The CA certificate
50	serial = $dir/serial # The current serial number
51	crlnumber = $dir/crlnumber # the current crl number
52	# must be commented out to leave a V1 CRL
53	crl = $dir/crl.pem # The current CRL
54	private_key = $dir/private/cakey.pem# The private key
55
56	x509_extensions = usr_cert # The extensions to add to the cert
57
58	# Comment out the following two lines for the "traditional"
59	# (and highly broken) format.
60	name_opt = ca_default # Subject Name options
61	cert_opt = ca_default # Certificate field options
62
63	# Extension copying option: use with caution.
64	# copy_extensions = copy
65
66	# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
67	# so this is commented out by default to leave a V1 CRL.
68	# crlnumber must also be commented out to leave a V1 CRL.
69	# crl_extensions = crl_ext
70
71	default_days = 365 # how long to certify for
72	default_crl_days= 30 # how long before next CRL
73	default_md = default # use public key default MD
74	preserve = no # keep passed DN ordering
75
76	# A few difference way of specifying how similar the request should look
77	# For type CA, the listed attributes must be the same, and the optional
78	# and supplied fields are just that :-)
79	policy = policy_match
80
81	# For the CA policy
82	[ policy_match ]
83	countryName = match
84	stateOrProvinceName = match
85	organizationName = match
86	organizationalUnitName = optional
87	commonName = supplied
88	emailAddress = optional
89
90	# For the 'anything' policy
91	# At this point in time, you must list all acceptable 'object'
92	# types.
93	[ policy_anything ]
94	countryName = optional
95	stateOrProvinceName = optional
96	localityName = optional
97	organizationName = optional
98	organizationalUnitName = optional
99	commonName = supplied
100	emailAddress = optional
101
102	####################################################################
103	[ req ]
104	default_bits = 1024
105	default_keyfile = privkey.pem
106	distinguished_name = req_distinguished_name
107	attributes = req_attributes
108	x509_extensions = v3_ca # The extensions to add to the self signed cert
109
110	# Passwords for private keys if not present they will be prompted for
111	# input_password = secret
112	# output_password = secret
113
114	# This sets a mask for permitted string types. There are several options.
115	# default: PrintableString, T61String, BMPString.
116	# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
117	# utf8only: only UTF8Strings (PKIX recommendation after 2004).
118	# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
119	# MASK:XXXX a literal mask value.
120	# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
121	string_mask = utf8only
122
123	# req_extensions = v3_req # The extensions to add to a certificate request
124
125	[ req_distinguished_name ]
126	countryName = Country Name (2 letter code)
127	countryName_default = AU
128	countryName_min = 2
129	countryName_max = 2
130
131	stateOrProvinceName = State or Province Name (full name)
132	stateOrProvinceName_default = Some-State
133
134	localityName = Locality Name (eg, city)
135
136	0.organizationName = Organization Name (eg, company)
137	0.organizationName_default = Internet Widgits Pty Ltd
138
139	# we can do this but it is not needed normally :-)
140	#1.organizationName = Second Organization Name (eg, company)
141	#1.organizationName_default = World Wide Web Pty Ltd
142
143	organizationalUnitName = Organizational Unit Name (eg, section)
144	#organizationalUnitName_default =
145
146	commonName = Common Name (e.g. server FQDN or YOUR name)
147	commonName_max = 64
148
149	emailAddress = Email Address
150	emailAddress_max = 64
151
152	# SET-ex3 = SET extension number 3
153
154	[ req_attributes ]
155	challengePassword = A challenge password
156	challengePassword_min = 4
157	challengePassword_max = 20
158
159	unstructuredName = An optional company name
160
161	[ usr_cert ]
162
163	# These extensions are added when 'ca' signs a request.
164
165	# This goes against PKIX guidelines but some CAs do it and some software
166	# requires this to avoid interpreting an end user certificate as a CA.
167
168	basicConstraints=CA:FALSE
169
170	# Here are some examples of the usage of nsCertType. If it is omitted
171	# the certificate can be used for anything except object signing.
172
173	# This is OK for an SSL server.
174	# nsCertType = server
175
176	# For an object signing certificate this would be used.
177	# nsCertType = objsign
178
179	# For normal client use this is typical
180	# nsCertType = client, email
181
182	# and for everything including object signing:
183	# nsCertType = client, email, objsign
184
185	# This is typical in keyUsage for a client certificate.
186	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
187
188	# This will be displayed in Netscape's comment listbox.
189	nsComment = "OpenSSL Generated Certificate"
190
191	# PKIX recommendations harmless if included in all certificates.
192	subjectKeyIdentifier=hash
193	authorityKeyIdentifier=keyid,issuer
194
195	# This stuff is for subjectAltName and issuerAltname.
196	# Import the email address.
197	# subjectAltName=email:copy
198	# An alternative to produce certificates that aren't
199	# deprecated according to PKIX.
200	# subjectAltName=email:move
201
202	# Copy subject details
203	# issuerAltName=issuer:copy
204
205	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
206	#nsBaseUrl
207	#nsRevocationUrl
208	#nsRenewalUrl
209	#nsCaPolicyUrl
210	#nsSslServerName
211
212	# This is required for TSA certificates.
213	# extendedKeyUsage = critical,timeStamping
214
215	[ v3_req ]
216
217	# Extensions to add to a certificate request
218
219	basicConstraints = CA:FALSE
220	keyUsage = nonRepudiation, digitalSignature, keyEncipherment
221
222	[ v3_ca ]
223
224
225	# Extensions for a typical CA
226
227
228	# PKIX recommendation.
229
230	subjectKeyIdentifier=hash
231
232	authorityKeyIdentifier=keyid:always,issuer
233
234	# This is what PKIX recommends but some broken software chokes on critical
235	# extensions.
236	#basicConstraints = critical,CA:true
237	# So we do this instead.
238	basicConstraints = CA:true
239
240	# Key usage: this is typical for a CA certificate. However since it will
241	# prevent it being used as an test self-signed certificate it is best
242	# left out by default.
243	# keyUsage = cRLSign, keyCertSign
244
245	# Some might want this also
246	# nsCertType = sslCA, emailCA
247
248	# Include email address in subject alt name: another PKIX recommendation
249	# subjectAltName=email:copy
250	# Copy issuer details
251	# issuerAltName=issuer:copy
252
253	# DER hex encoding of an extension: beware experts only!
254	# obj=DER:02:03
255	# Where 'obj' is a standard or added object
256	# You can even override a supported extension:
257	# basicConstraints= critical, DER:30:03:01:01:FF
258
259	[ crl_ext ]
260
261	# CRL extensions.
262	# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
263
264	# issuerAltName=issuer:copy
265	authorityKeyIdentifier=keyid:always
266
267	[ proxy_cert_ext ]
268	# These extensions should be added when creating a proxy certificate
269
270	# This goes against PKIX guidelines but some CAs do it and some software
271	# requires this to avoid interpreting an end user certificate as a CA.
272
273	basicConstraints=CA:FALSE
274
275	# Here are some examples of the usage of nsCertType. If it is omitted
276	# the certificate can be used for anything except object signing.
277
278	# This is OK for an SSL server.
279	# nsCertType = server
280
281	# For an object signing certificate this would be used.
282	# nsCertType = objsign
283
284	# For normal client use this is typical
285	# nsCertType = client, email
286
287	# and for everything including object signing:
288	# nsCertType = client, email, objsign
289
290	# This is typical in keyUsage for a client certificate.
291	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
292
293	# This will be displayed in Netscape's comment listbox.
294	nsComment = "OpenSSL Generated Certificate"
295
296	# PKIX recommendations harmless if included in all certificates.
297	subjectKeyIdentifier=hash
298	authorityKeyIdentifier=keyid,issuer
299
300	# This stuff is for subjectAltName and issuerAltname.
301	# Import the email address.
302	# subjectAltName=email:copy
303	# An alternative to produce certificates that aren't
304	# deprecated according to PKIX.
305	# subjectAltName=email:move
306
307	# Copy subject details
308	# issuerAltName=issuer:copy
309
310	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
311	#nsBaseUrl
312	#nsRevocationUrl
313	#nsRenewalUrl
314	#nsCaPolicyUrl
315	#nsSslServerName
316
317	# This really needs to be in place for it to be a proxy certificate.
318	proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
319
320	####################################################################
321	[ tsa ]
322
323	default_tsa = tsa_config1 # the default TSA section
324
325	[ tsa_config1 ]
326
327	# These are used by the TSA reply generation only.
328	dir = ./demoCA # TSA root directory
329	serial = $dir/tsaserial # The current serial number (mandatory)
330	crypto_device = builtin # OpenSSL engine to use for signing
331	signer_cert = $dir/tsacert.pem # The TSA signing certificate
332	# (optional)
333	certs = $dir/cacert.pem # Certificate chain to include in reply
334	# (optional)
335	signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
336
337	default_policy = tsa_policy1 # Policy if request did not specify it
338	# (optional)
339	other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
340	digests = md5, sha1 # Acceptable message digests (mandatory)
341	accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
342	clock_precision_digits = 0 # number of digits after dot. (optional)
343	ordering = yes # Is ordering defined for timestamps?
344	# (optional, default: no)
345	tsa_name = yes # Must the TSA name be included in the reply?
346	# (optional, default: no)
347	ess_cert_id_chain = no # Must the ESS cert id chain be included?
348	# (optional, default: no)