1 files changed, 0 insertions, 350 deletions
diff --git a/src/lib/libssl/doc/openssl.cnf b/src/lib/libssl/doc/openssl.cnf
deleted file mode 100644
index 18760c6e67..0000000000
--- a/src/lib/libssl/doc/openssl.cnf
+++ /dev/null
@@ -1,350 +0,0 @@
-#
-# OpenSSL example configuration file.
-# This is mostly being used for generation of certificate requests.
-#
-# This definition stops the following lines choking if HOME isn't
-# defined.
-HOME                    = .
-RANDFILE                = $ENV::HOME/.rnd
-# Extra OBJECT IDENTIFIER info:
-#oid_file               = $ENV::HOME/.oid
-oid_section             = new_oids
-# To use this configuration file with the "-extfile" option of the
-# "openssl x509" utility, name here the section containing the
-# X.509v3 extensions to use:
-# extensions            = 
-# (Alternatively, use a configuration file that has only
-# X.509v3 extensions in its main [= default] section.)
-[ new_oids ]
-# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
-# Add a simple OID like this:
-# testoid1=1.2.3.4
-# Or use config file substitution like this:
-# testoid2=${testoid1}.5.6
-# Policies used by the TSA examples.
-tsa_policy1 = 1.2.3.4.1
-tsa_policy2 = 1.2.3.4.5.6
-tsa_policy3 = 1.2.3.4.5.7
-####################################################################
-[ ca ]
-default_ca      = CA_default            # The default ca section
-####################################################################
-[ CA_default ]
-dir             = ./demoCA              # Where everything is kept
-certs           = $dir/certs            # Where the issued certs are kept
-crl_dir         = $dir/crl              # Where the issued crl are kept
-database        = $dir/index.txt        # database index file.
-#unique_subject = no                    # Set to 'no' to allow creation of
-                                        # several ctificates with same subject.
-new_certs_dir   = $dir/newcerts         # default place for new certs.
-certificate     = $dir/cacert.pem       # The CA certificate
-serial          = $dir/serial           # The current serial number
-crlnumber       = $dir/crlnumber        # the current crl number
-                                        # must be commented out to leave a V1 CRL
-crl             = $dir/crl.pem          # The current CRL
-private_key     = $dir/private/cakey.pem# The private key
-RANDFILE        = $dir/private/.rand    # private random number file
-x509_extensions = usr_cert              # The extentions to add to the cert
-# Comment out the following two lines for the "traditional"
-# (and highly broken) format.
-name_opt        = ca_default            # Subject Name options
-cert_opt        = ca_default            # Certificate field options
-# Extension copying option: use with caution.
-# copy_extensions = copy
-# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
-# so this is commented out by default to leave a V1 CRL.
-# crlnumber must also be commented out to leave a V1 CRL.
-# crl_extensions        = crl_ext
-default_days    = 365                   # how long to certify for
-default_crl_days= 30                    # how long before next CRL
-default_md      = default               # use public key default MD
-preserve        = no                    # keep passed DN ordering
-# A few difference way of specifying how similar the request should look
-# For type CA, the listed attributes must be the same, and the optional
-# and supplied fields are just that :-)
-policy          = policy_match
-# For the CA policy
-[ policy_match ]
-countryName             = match
-stateOrProvinceName     = match
-organizationName        = match
-organizationalUnitName  = optional
-commonName              = supplied
-emailAddress            = optional
-# For the 'anything' policy
-# At this point in time, you must list all acceptable 'object'
-# types.
-[ policy_anything ]
-countryName             = optional
-stateOrProvinceName     = optional
-localityName            = optional
-organizationName        = optional
-organizationalUnitName  = optional
-commonName              = supplied
-emailAddress            = optional
-####################################################################
-[ req ]
-default_bits            = 1024
-default_keyfile         = privkey.pem
-distinguished_name      = req_distinguished_name
-attributes              = req_attributes
-x509_extensions = v3_ca # The extentions to add to the self signed cert
-# Passwords for private keys if not present they will be prompted for
-# input_password = secret
-# output_password = secret
-# This sets a mask for permitted string types. There are several options. 
-# default: PrintableString, T61String, BMPString.
-# pkix   : PrintableString, BMPString (PKIX recommendation before 2004)
-# utf8only: only UTF8Strings (PKIX recommendation after 2004).
-# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
-# MASK:XXXX a literal mask value.
-# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
-string_mask = utf8only
-# req_extensions = v3_req # The extensions to add to a certificate request
-[ req_distinguished_name ]
-countryName                     = Country Name (2 letter code)
-countryName_default             = AU
-countryName_min                 = 2
-countryName_max                 = 2
-stateOrProvinceName             = State or Province Name (full name)
-stateOrProvinceName_default     = Some-State
-localityName                    = Locality Name (eg, city)
-0.organizationName              = Organization Name (eg, company)
-0.organizationName_default      = Internet Widgits Pty Ltd
-# we can do this but it is not needed normally :-)
-#1.organizationName             = Second Organization Name (eg, company)
-#1.organizationName_default     = World Wide Web Pty Ltd
-organizationalUnitName          = Organizational Unit Name (eg, section)
-#organizationalUnitName_default =
-commonName                      = Common Name (e.g. server FQDN or YOUR name)
-commonName_max                  = 64
-emailAddress                    = Email Address
-emailAddress_max                = 64
-# SET-ex3                       = SET extension number 3
-[ req_attributes ]
-challengePassword               = A challenge password
-challengePassword_min           = 4
-challengePassword_max           = 20
-unstructuredName                = An optional company name
-[ usr_cert ]
-# These extensions are added when 'ca' signs a request.
-# This goes against PKIX guidelines but some CAs do it and some software
-# requires this to avoid interpreting an end user certificate as a CA.
-basicConstraints=CA:FALSE
-# Here are some examples of the usage of nsCertType. If it is omitted
-# the certificate can be used for anything *except* object signing.
-# This is OK for an SSL server.
-# nsCertType                    = server
-# For an object signing certificate this would be used.
-# nsCertType = objsign
-# For normal client use this is typical
-# nsCertType = client, email
-# and for everything including object signing:
-# nsCertType = client, email, objsign
-# This is typical in keyUsage for a client certificate.
-# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-# This will be displayed in Netscape's comment listbox.
-nsComment                       = "OpenSSL Generated Certificate"
-# PKIX recommendations harmless if included in all certificates.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer
-# This stuff is for subjectAltName and issuerAltname.
-# Import the email address.
-# subjectAltName=email:copy
-# An alternative to produce certificates that aren't
-# deprecated according to PKIX.
-# subjectAltName=email:move
-# Copy subject details
-# issuerAltName=issuer:copy
-#nsCaRevocationUrl              = http://www.domain.dom/ca-crl.pem
-#nsBaseUrl
-#nsRevocationUrl
-#nsRenewalUrl
-#nsCaPolicyUrl
-#nsSslServerName
-# This is required for TSA certificates.
-# extendedKeyUsage = critical,timeStamping
-[ v3_req ]
-# Extensions to add to a certificate request
-basicConstraints = CA:FALSE
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-[ v3_ca ]
-# Extensions for a typical CA
-# PKIX recommendation.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid:always,issuer
-# This is what PKIX recommends but some broken software chokes on critical
-# extensions.
-#basicConstraints = critical,CA:true
-# So we do this instead.
-basicConstraints = CA:true
-# Key usage: this is typical for a CA certificate. However since it will
-# prevent it being used as an test self-signed certificate it is best
-# left out by default.
-# keyUsage = cRLSign, keyCertSign
-# Some might want this also
-# nsCertType = sslCA, emailCA
-# Include email address in subject alt name: another PKIX recommendation
-# subjectAltName=email:copy
-# Copy issuer details
-# issuerAltName=issuer:copy
-# DER hex encoding of an extension: beware experts only!
-# obj=DER:02:03
-# Where 'obj' is a standard or added object
-# You can even override a supported extension:
-# basicConstraints= critical, DER:30:03:01:01:FF
-[ crl_ext ]
-# CRL extensions.
-# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
-# issuerAltName=issuer:copy
-authorityKeyIdentifier=keyid:always
-[ proxy_cert_ext ]
-# These extensions should be added when creating a proxy certificate
-# This goes against PKIX guidelines but some CAs do it and some software
-# requires this to avoid interpreting an end user certificate as a CA.
-basicConstraints=CA:FALSE
-# Here are some examples of the usage of nsCertType. If it is omitted
-# the certificate can be used for anything *except* object signing.
-# This is OK for an SSL server.
-# nsCertType                    = server
-# For an object signing certificate this would be used.
-# nsCertType = objsign
-# For normal client use this is typical
-# nsCertType = client, email
-# and for everything including object signing:
-# nsCertType = client, email, objsign
-# This is typical in keyUsage for a client certificate.
-# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-# This will be displayed in Netscape's comment listbox.
-nsComment                       = "OpenSSL Generated Certificate"
-# PKIX recommendations harmless if included in all certificates.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer
-# This stuff is for subjectAltName and issuerAltname.
-# Import the email address.
-# subjectAltName=email:copy
-# An alternative to produce certificates that aren't
-# deprecated according to PKIX.
-# subjectAltName=email:move
-# Copy subject details
-# issuerAltName=issuer:copy
-#nsCaRevocationUrl              = http://www.domain.dom/ca-crl.pem
-#nsBaseUrl
-#nsRevocationUrl
-#nsRenewalUrl
-#nsCaPolicyUrl
-#nsSslServerName
-# This really needs to be in place for it to be a proxy certificate.
-proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
-####################################################################
-[ tsa ]
-default_tsa = tsa_config1       # the default TSA section
-[ tsa_config1 ]
-# These are used by the TSA reply generation only.
-dir             = ./demoCA              # TSA root directory
-serial          = $dir/tsaserial        # The current serial number (mandatory)
-crypto_device   = builtin               # OpenSSL engine to use for signing
-signer_cert     = $dir/tsacert.pem      # The TSA signing certificate
-                                        # (optional)
-certs           = $dir/cacert.pem       # Certificate chain to include in reply
-                                        # (optional)
-signer_key      = $dir/private/tsakey.pem # The TSA private key (optional)
-default_policy  = tsa_policy1           # Policy if request did not specify it
-                                        # (optional)
-other_policies  = tsa_policy2, tsa_policy3      # acceptable policies (optional)
-digests         = md5, sha1             # Acceptable message digests (mandatory)
-accuracy        = secs:1, millisecs:500, microsecs:100  # (optional)
-clock_precision_digits  = 0     # number of digits after dot. (optional)
-ordering                = yes   # Is ordering defined for timestamps?
-                                # (optional, default: no)
-tsa_name                = yes   # Must the TSA name be included in the reply?
-                                # (optional, default: no)
-ess_cert_id_chain       = no    # Must the ESS cert id chain be included?
-                                # (optional, default: no)

diff --git a/src/lib/libssl/doc/openssl.cnf b/src/lib/libssl/doc/openssl.cnf deleted file mode 100644 index 18760c6e67..0000000000 --- a/src/lib/libssl/doc/openssl.cnf +++ /dev/null
@@ -1,350 +0,0 @@
1	#
2	# OpenSSL example configuration file.
3	# This is mostly being used for generation of certificate requests.
4	#
5
6	# This definition stops the following lines choking if HOME isn't
7	# defined.
8	HOME = .
9	RANDFILE = $ENV::HOME/.rnd
10
11	# Extra OBJECT IDENTIFIER info:
12	#oid_file = $ENV::HOME/.oid
13	oid_section = new_oids
14
15	# To use this configuration file with the "-extfile" option of the
16	# "openssl x509" utility, name here the section containing the
17	# X.509v3 extensions to use:
18	# extensions =
19	# (Alternatively, use a configuration file that has only
20	# X.509v3 extensions in its main [= default] section.)
21
22	[ new_oids ]
23
24	# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
25	# Add a simple OID like this:
26	# testoid1=1.2.3.4
27	# Or use config file substitution like this:
28	# testoid2=${testoid1}.5.6
29
30	# Policies used by the TSA examples.
31	tsa_policy1 = 1.2.3.4.1
32	tsa_policy2 = 1.2.3.4.5.6
33	tsa_policy3 = 1.2.3.4.5.7
34
35	####################################################################
36	[ ca ]
37	default_ca = CA_default # The default ca section
38
39	####################################################################
40	[ CA_default ]
41
42	dir = ./demoCA # Where everything is kept
43	certs = $dir/certs # Where the issued certs are kept
44	crl_dir = $dir/crl # Where the issued crl are kept
45	database = $dir/index.txt # database index file.
46	#unique_subject = no # Set to 'no' to allow creation of
47	# several ctificates with same subject.
48	new_certs_dir = $dir/newcerts # default place for new certs.
49
50	certificate = $dir/cacert.pem # The CA certificate
51	serial = $dir/serial # The current serial number
52	crlnumber = $dir/crlnumber # the current crl number
53	# must be commented out to leave a V1 CRL
54	crl = $dir/crl.pem # The current CRL
55	private_key = $dir/private/cakey.pem# The private key
56	RANDFILE = $dir/private/.rand # private random number file
57
58	x509_extensions = usr_cert # The extentions to add to the cert
59
60	# Comment out the following two lines for the "traditional"
61	# (and highly broken) format.
62	name_opt = ca_default # Subject Name options
63	cert_opt = ca_default # Certificate field options
64
65	# Extension copying option: use with caution.
66	# copy_extensions = copy
67
68	# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
69	# so this is commented out by default to leave a V1 CRL.
70	# crlnumber must also be commented out to leave a V1 CRL.
71	# crl_extensions = crl_ext
72
73	default_days = 365 # how long to certify for
74	default_crl_days= 30 # how long before next CRL
75	default_md = default # use public key default MD
76	preserve = no # keep passed DN ordering
77
78	# A few difference way of specifying how similar the request should look
79	# For type CA, the listed attributes must be the same, and the optional
80	# and supplied fields are just that :-)
81	policy = policy_match
82
83	# For the CA policy
84	[ policy_match ]
85	countryName = match
86	stateOrProvinceName = match
87	organizationName = match
88	organizationalUnitName = optional
89	commonName = supplied
90	emailAddress = optional
91
92	# For the 'anything' policy
93	# At this point in time, you must list all acceptable 'object'
94	# types.
95	[ policy_anything ]
96	countryName = optional
97	stateOrProvinceName = optional
98	localityName = optional
99	organizationName = optional
100	organizationalUnitName = optional
101	commonName = supplied
102	emailAddress = optional
103
104	####################################################################
105	[ req ]
106	default_bits = 1024
107	default_keyfile = privkey.pem
108	distinguished_name = req_distinguished_name
109	attributes = req_attributes
110	x509_extensions = v3_ca # The extentions to add to the self signed cert
111
112	# Passwords for private keys if not present they will be prompted for
113	# input_password = secret
114	# output_password = secret
115
116	# This sets a mask for permitted string types. There are several options.
117	# default: PrintableString, T61String, BMPString.
118	# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
119	# utf8only: only UTF8Strings (PKIX recommendation after 2004).
120	# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
121	# MASK:XXXX a literal mask value.
122	# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
123	string_mask = utf8only
124
125	# req_extensions = v3_req # The extensions to add to a certificate request
126
127	[ req_distinguished_name ]
128	countryName = Country Name (2 letter code)
129	countryName_default = AU
130	countryName_min = 2
131	countryName_max = 2
132
133	stateOrProvinceName = State or Province Name (full name)
134	stateOrProvinceName_default = Some-State
135
136	localityName = Locality Name (eg, city)
137
138	0.organizationName = Organization Name (eg, company)
139	0.organizationName_default = Internet Widgits Pty Ltd
140
141	# we can do this but it is not needed normally :-)
142	#1.organizationName = Second Organization Name (eg, company)
143	#1.organizationName_default = World Wide Web Pty Ltd
144
145	organizationalUnitName = Organizational Unit Name (eg, section)
146	#organizationalUnitName_default =
147
148	commonName = Common Name (e.g. server FQDN or YOUR name)
149	commonName_max = 64
150
151	emailAddress = Email Address
152	emailAddress_max = 64
153
154	# SET-ex3 = SET extension number 3
155
156	[ req_attributes ]
157	challengePassword = A challenge password
158	challengePassword_min = 4
159	challengePassword_max = 20
160
161	unstructuredName = An optional company name
162
163	[ usr_cert ]
164
165	# These extensions are added when 'ca' signs a request.
166
167	# This goes against PKIX guidelines but some CAs do it and some software
168	# requires this to avoid interpreting an end user certificate as a CA.
169
170	basicConstraints=CA:FALSE
171
172	# Here are some examples of the usage of nsCertType. If it is omitted
173	# the certificate can be used for anything except object signing.
174
175	# This is OK for an SSL server.
176	# nsCertType = server
177
178	# For an object signing certificate this would be used.
179	# nsCertType = objsign
180
181	# For normal client use this is typical
182	# nsCertType = client, email
183
184	# and for everything including object signing:
185	# nsCertType = client, email, objsign
186
187	# This is typical in keyUsage for a client certificate.
188	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
189
190	# This will be displayed in Netscape's comment listbox.
191	nsComment = "OpenSSL Generated Certificate"
192
193	# PKIX recommendations harmless if included in all certificates.
194	subjectKeyIdentifier=hash
195	authorityKeyIdentifier=keyid,issuer
196
197	# This stuff is for subjectAltName and issuerAltname.
198	# Import the email address.
199	# subjectAltName=email:copy
200	# An alternative to produce certificates that aren't
201	# deprecated according to PKIX.
202	# subjectAltName=email:move
203
204	# Copy subject details
205	# issuerAltName=issuer:copy
206
207	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
208	#nsBaseUrl
209	#nsRevocationUrl
210	#nsRenewalUrl
211	#nsCaPolicyUrl
212	#nsSslServerName
213
214	# This is required for TSA certificates.
215	# extendedKeyUsage = critical,timeStamping
216
217	[ v3_req ]
218
219	# Extensions to add to a certificate request
220
221	basicConstraints = CA:FALSE
222	keyUsage = nonRepudiation, digitalSignature, keyEncipherment
223
224	[ v3_ca ]
225
226
227	# Extensions for a typical CA
228
229
230	# PKIX recommendation.
231
232	subjectKeyIdentifier=hash
233
234	authorityKeyIdentifier=keyid:always,issuer
235
236	# This is what PKIX recommends but some broken software chokes on critical
237	# extensions.
238	#basicConstraints = critical,CA:true
239	# So we do this instead.
240	basicConstraints = CA:true
241
242	# Key usage: this is typical for a CA certificate. However since it will
243	# prevent it being used as an test self-signed certificate it is best
244	# left out by default.
245	# keyUsage = cRLSign, keyCertSign
246
247	# Some might want this also
248	# nsCertType = sslCA, emailCA
249
250	# Include email address in subject alt name: another PKIX recommendation
251	# subjectAltName=email:copy
252	# Copy issuer details
253	# issuerAltName=issuer:copy
254
255	# DER hex encoding of an extension: beware experts only!
256	# obj=DER:02:03
257	# Where 'obj' is a standard or added object
258	# You can even override a supported extension:
259	# basicConstraints= critical, DER:30:03:01:01:FF
260
261	[ crl_ext ]
262
263	# CRL extensions.
264	# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
265
266	# issuerAltName=issuer:copy
267	authorityKeyIdentifier=keyid:always
268
269	[ proxy_cert_ext ]
270	# These extensions should be added when creating a proxy certificate
271
272	# This goes against PKIX guidelines but some CAs do it and some software
273	# requires this to avoid interpreting an end user certificate as a CA.
274
275	basicConstraints=CA:FALSE
276
277	# Here are some examples of the usage of nsCertType. If it is omitted
278	# the certificate can be used for anything except object signing.
279
280	# This is OK for an SSL server.
281	# nsCertType = server
282
283	# For an object signing certificate this would be used.
284	# nsCertType = objsign
285
286	# For normal client use this is typical
287	# nsCertType = client, email
288
289	# and for everything including object signing:
290	# nsCertType = client, email, objsign
291
292	# This is typical in keyUsage for a client certificate.
293	# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
294
295	# This will be displayed in Netscape's comment listbox.
296	nsComment = "OpenSSL Generated Certificate"
297
298	# PKIX recommendations harmless if included in all certificates.
299	subjectKeyIdentifier=hash
300	authorityKeyIdentifier=keyid,issuer
301
302	# This stuff is for subjectAltName and issuerAltname.
303	# Import the email address.
304	# subjectAltName=email:copy
305	# An alternative to produce certificates that aren't
306	# deprecated according to PKIX.
307	# subjectAltName=email:move
308
309	# Copy subject details
310	# issuerAltName=issuer:copy
311
312	#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
313	#nsBaseUrl
314	#nsRevocationUrl
315	#nsRenewalUrl
316	#nsCaPolicyUrl
317	#nsSslServerName
318
319	# This really needs to be in place for it to be a proxy certificate.
320	proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
321
322	####################################################################
323	[ tsa ]
324
325	default_tsa = tsa_config1 # the default TSA section
326
327	[ tsa_config1 ]
328
329	# These are used by the TSA reply generation only.
330	dir = ./demoCA # TSA root directory
331	serial = $dir/tsaserial # The current serial number (mandatory)
332	crypto_device = builtin # OpenSSL engine to use for signing
333	signer_cert = $dir/tsacert.pem # The TSA signing certificate
334	# (optional)
335	certs = $dir/cacert.pem # Certificate chain to include in reply
336	# (optional)
337	signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
338
339	default_policy = tsa_policy1 # Policy if request did not specify it
340	# (optional)
341	other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
342	digests = md5, sha1 # Acceptable message digests (mandatory)
343	accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
344	clock_precision_digits = 0 # number of digits after dot. (optional)
345	ordering = yes # Is ordering defined for timestamps?
346	# (optional, default: no)
347	tsa_name = yes # Must the TSA name be included in the reply?
348	# (optional, default: no)
349	ess_cert_id_chain = no # Must the ESS cert id chain be included?
350	# (optional, default: no)