4 files changed, 0 insertions, 397 deletions
diff --git a/src/regress/lib/libcrypto/CA/Makefile b/src/regress/lib/libcrypto/CA/Makefile
deleted file mode 100644
index c31c99c946..0000000000
--- a/src/regress/lib/libcrypto/CA/Makefile
+++ /dev/null
@@ -1,21 +0,0 @@
-#       $OpenBSD: Makefile,v 1.1 2017/01/25 10:29:34 beck Exp $
-TESTS = \
-        doit.sh
-REGRESS_TARGETS= all_tests
-CLEANFILES += \
-1000.pem client.cert.pem intermediate.cert.pem root.cert.pem  server.csr.pem \
-1001.pem client.csr.pem intermediate.csr.pem  root.key.pem  server.key.pem \
-chain.pem client.key.pem intermediate.key.pem  server.cert.pem \
-int.txt  int.txt.attr int.txt.old int.txt.attr.old  \
-root.txt root.txt.attr root.txt.old root.txt.attr.old \
-intserial rootserial intserial.old rootserial.old
-all_tests: ${TESTS}
-        @for test in $>; do \
-                ./$$test; \
-        done
-.include <bsd.regress.mk>
diff --git a/src/regress/lib/libcrypto/CA/doit.sh b/src/regress/lib/libcrypto/CA/doit.sh
deleted file mode 100755
index 110d89d67f..0000000000
--- a/src/regress/lib/libcrypto/CA/doit.sh
+++ /dev/null
@@ -1,116 +0,0 @@
-#!/bin/sh
-#       $OpenBSD: doit.sh,v 1.2 2018/07/17 17:06:49 tb Exp $
-rm -rf root intermediate certs
-echo 1000 > rootserial
-cat /dev/null > root.txt
-echo 1000 > intserial
-cat /dev/null > int.txt
-# Vanna Vanna make me a root cert
-openssl genrsa -out root.key.pem 4096
-if [ $? -ne 0 ]; then
-   echo "*** Fail;  Can't generate root rsa 4096 key"
-   exit 1
-fi   
-openssl req -batch -config root.cnf -key root.key.pem -new -x509 -days 365 -sha256 -extensions v3_ca -out root.cert.pem
-if [ $? -ne 0 ]; then
-   echo "*** Fail;  Can't generate root req"
-   exit 1
-fi   
-# Make intermediate
-openssl genrsa -out intermediate.key.pem 2048
-if [ $? -ne 0 ]; then
-   echo "*** Fail;  Can't generate intermediate rsa 2048 key"
-   exit 1
-fi   
-openssl req -batch -config intermediate.cnf -new -sha256 \
-      -key intermediate.key.pem \
-      -out intermediate.csr.pem
-if [ $? -ne 0 ]; then
-   echo "*** Fail;  Can't generate intermediate req"
-   exit 1
-fi   
-# Sign intermediate
-openssl ca -batch -config root.cnf -extensions v3_intermediate_ca -days 10 -notext -md sha256 -in intermediate.csr.pem -out intermediate.cert.pem 
-if [ $? -ne 0 ]; then
-   echo "*** Fail;  Can't sign intermediate"
-   exit 1
-fi   
-# Verify Intermediate
-openssl verify -CAfile ca.cert.pem intermediate.cert.pem
-if [ $? -ne 0]; then
-   echo "*** Fail; Intermediate CA does not validate"
-   exit 1
-fi   
-cat intermediate.cert.pem root.cert.pem > chain.pem
-# make a server certificate
-openssl genrsa -out server.key.pem 2048
-if [ $? -ne 0]; then
-   echo "*** Fail; genrsa server"
-   exit 1
-fi   
-openssl req -batch -config intermediate.cnf \
-      -key server.key.pem \
-      -new -sha256 -out server.csr.pem \
-      -subj '/CN=server/O=OpenBSD/OU=So and Sos/C=CA'
-if [ $? -ne 0]; then
-   echo "*** Fail; server req"
-   exit 1
-fi   
-# sign server key
-openssl ca -batch -config intermediate.cnf -extensions server_cert -days 5 -notext -md sha256 -in server.csr.pem -out server.cert.pem
-if [ $? -ne 0 ]; then
-   echo "*** Fail; server sign"
-   exit 1
-fi   
-# make a client certificate
-openssl genrsa -out client.key.pem 2048
-if [ $? -ne 0]; then
-   echo "*** Fail; genrsa client"
-   exit 1
-fi   
-openssl req -batch -config intermediate.cnf \
-      -key client.key.pem \
-      -new -sha256 -out client.csr.pem \
-      -subj '/CN=client/O=OpenBSD/OU=So and Sos/C=CA'
-if [ $? -ne 0]; then
-   echo "*** Fail; client req"
-   exit 1
-fi   
-# sign client key
-openssl ca -batch -config intermediate.cnf -extensions usr_cert -days 5 -notext -md sha256 -in client.csr.pem -out client.cert.pem
-if [ $? -ne 0 ]; then
-   echo "*** Fail; client sign"
-   exit 1
-fi
-# Verify Intermediate
-openssl verify -purpose sslserver -CAfile chain.pem server.cert.pem
-if [ $? -ne 0 ]; then
-   echo "*** Fail; server cert does not validate"
-   exit 1
-fi   
-# Verify Intermediate
-openssl verify -purpose sslclient -CAfile chain.pem client.cert.pem
-if [ $? -ne 0 ]; then
-   echo "*** Fail; client cert does not validate"
-   exit 1
-fi   
diff --git a/src/regress/lib/libcrypto/CA/intermediate.cnf b/src/regress/lib/libcrypto/CA/intermediate.cnf
deleted file mode 100644
index 9a95487c00..0000000000
--- a/src/regress/lib/libcrypto/CA/intermediate.cnf
+++ /dev/null
@@ -1,130 +0,0 @@
-#       $OpenBSD: intermediate.cnf,v 1.2 2018/07/17 17:06:49 tb Exp $
-# For regression tests
-default_ca = CA_regress
-[ CA_regress ]
-# Directory and file locations.
-dir               = .
-certs             = $dir
-crl_dir           = $dir
-database          = $dir/int.txt
-serial            = $dir/intserial
-new_certs_dir     = $dir
-# The root key and root certificate.
-private_key       = $dir/intermediate.key.pem
-certificate       = $dir/intermediate.cert.pem
-# For certificate revocation lists.
-crlnumber         = $dir/crlnumber
-crl               = $dir/ca.crl.pem
-crl_extensions    = crl_ext
-default_crl_days  = 30
-# SHA-1 is deprecated, so use SHA-2 instead.
-default_md        = sha256
-name_opt          = ca_default
-cert_opt          = ca_default
-default_days      = 10
-preserve          = no
-policy            = policy_loose
-[ policy_strict ]
-# The root CA should only sign intermediate certificates that match.
-# See the POLICY FORMAT section of `man ca`.
-countryName             = match
-stateOrProvinceName     = match
-organizationName        = match
-organizationalUnitName  = optional
-commonName              = supplied
-emailAddress            = optional
-[ policy_loose ]
-# Allow the intermediate CA to sign a more diverse range of certificates.
-# See the POLICY FORMAT section of the `ca` man page.
-countryName             = optional
-stateOrProvinceName     = optional
-localityName            = optional
-organizationName        = optional
-organizationalUnitName  = optional
-commonName              = supplied
-emailAddress            = optional
-[ req ]
-# Options for the `req` tool (`man req`).
-default_bits        = 2048
-distinguished_name  = req_distinguished_name
-string_mask         = utf8only
-# SHA-1 is deprecated, so use SHA-2 instead.
-default_md          = sha256
-# Extension to add when the -x509 option is used.
-x509_extensions     = v3_ca
-[ req_distinguished_name ]
-# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
-countryName                     = Country Name (2 letter code)
-stateOrProvinceName             = State or Province Name
-localityName                    = Locality Name
-0.organizationName              = Organization Name
-organizationalUnitName          = Organizational Unit Name
-commonName                      = Common Name
-emailAddress                    = Email Address
-# Optionally, specify some defaults.
-countryName_default             = CA
-stateOrProvinceName_default     = Alberta
-localityName_default            = Edmonton
-0.organizationName_default      = OpenBSD
-organizationalUnitName_default  = So and Sos
-emailAddress_default            = evilsoandsos@openbsd.org
-commonName_default              = Regress Intermediate CA
-[ v3_ca ]
-# Extensions for a typical CA (`man x509v3_config`).
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer
-basicConstraints = critical, CA:true
-keyUsage = critical, digitalSignature, cRLSign, keyCertSign
-[ v3_intermediate_ca ]
-# Extensions for a typical intermediate CA (`man x509v3_config`).
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer
-basicConstraints = critical, CA:true, pathlen:0
-keyUsage = critical, digitalSignature, cRLSign, keyCertSign
-[ usr_cert ]
-# Extensions for client certificates (`man x509v3_config`).
-basicConstraints = CA:FALSE
-nsCertType = client, email
-nsComment = "OpenSSL Generated Client Certificate"
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid,issuer
-keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
-extendedKeyUsage = clientAuth, emailProtection
-[ server_cert ]
-# Extensions for server certificates (`man x509v3_config`).
-basicConstraints = CA:FALSE
-nsCertType = server
-nsComment = "OpenSSL Generated Server Certificate"
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid,issuer:always
-keyUsage = critical, digitalSignature, keyEncipherment
-extendedKeyUsage = serverAuth
-[ crl_ext ]
-# Extension for CRLs (`man x509v3_config`).
-authorityKeyIdentifier=keyid:always
-[ ocsp ]
-# Extension for OCSP signing certificates (`man ocsp`).
-basicConstraints = CA:FALSE
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid,issuer
-keyUsage = critical, digitalSignature
-extendedKeyUsage = critical, OCSPSigning
diff --git a/src/regress/lib/libcrypto/CA/root.cnf b/src/regress/lib/libcrypto/CA/root.cnf
deleted file mode 100644
index b22e161476..0000000000
--- a/src/regress/lib/libcrypto/CA/root.cnf
+++ /dev/null
@@ -1,130 +0,0 @@
-#       $OpenBSD: root.cnf,v 1.2 2018/07/17 17:06:49 tb Exp $
-# For regression tests
-default_ca = CA_regress
-[ CA_regress ]
-# Directory and file locations.
-dir               = .
-certs             = $dir
-crl_dir           = $dir
-database          = $dir/root.txt
-serial            = $dir/rootserial
-new_certs_dir     = $dir
-# The root key and root certificate.
-private_key       = $dir/root.key.pem
-certificate       = $dir/root.cert.pem
-# For certificate revocation lists.
-crlnumber         = $dir/crlnumber
-crl               = $dir/ca.crl.pem
-crl_extensions    = crl_ext
-default_crl_days  = 30
-# SHA-1 is deprecated, so use SHA-2 instead.
-default_md        = sha256
-name_opt          = ca_default
-cert_opt          = ca_default
-default_days      = 375
-preserve          = no
-policy            = policy_strict
-[ policy_strict ]
-# The root CA should only sign intermediate certificates that match.
-# See the POLICY FORMAT section of `man ca`.
-countryName             = match
-stateOrProvinceName     = match
-organizationName        = match
-organizationalUnitName  = optional
-commonName              = supplied
-emailAddress            = optional
-[ policy_loose ]
-# Allow the intermediate CA to sign a more diverse range of certificates.
-# See the POLICY FORMAT section of the `ca` man page.
-countryName             = optional
-stateOrProvinceName     = optional
-localityName            = optional
-organizationName        = optional
-organizationalUnitName  = optional
-commonName              = supplied
-emailAddress            = optional
-[ req ]
-# Options for the `req` tool (`man req`).
-default_bits        = 2048
-distinguished_name  = req_distinguished_name
-string_mask         = utf8only
-# SHA-1 is deprecated, so use SHA-2 instead.
-default_md          = sha256
-# Extension to add when the -x509 option is used.
-x509_extensions     = v3_ca
-[ req_distinguished_name ]
-# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
-countryName                     = Country Name (2 letter code)
-stateOrProvinceName             = State or Province Name
-localityName                    = Locality Name
-0.organizationName              = Organization Name
-organizationalUnitName          = Organizational Unit Name
-commonName                      = Common Name
-emailAddress                    = Email Address
-# Optionally, specify some defaults.
-countryName_default             = CA
-stateOrProvinceName_default     = Alberta
-localityName_default            = Edmonton
-0.organizationName_default      = OpenBSD
-organizationalUnitName_default  = So and Sos
-emailAddress_default            = evilsoandsos@openbsd.org
-commonName_default              = Regress Root CA
-[ v3_ca ]
-# Extensions for a typical CA (`man x509v3_config`).
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer
-basicConstraints = critical, CA:true
-keyUsage = critical, digitalSignature, cRLSign, keyCertSign
-[ v3_intermediate_ca ]
-# Extensions for a typical intermediate CA (`man x509v3_config`).
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer
-basicConstraints = critical, CA:true, pathlen:0
-keyUsage = critical, digitalSignature, cRLSign, keyCertSign
-[ usr_cert ]
-# Extensions for client certificates (`man x509v3_config`).
-basicConstraints = CA:FALSE
-nsCertType = client, email
-nsComment = "OpenSSL Generated Client Certificate"
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid,issuer
-keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
-extendedKeyUsage = clientAuth, emailProtection
-[ server_cert ]
-# Extensions for server certificates (`man x509v3_config`).
-basicConstraints = CA:FALSE
-nsCertType = server
-nsComment = "OpenSSL Generated Server Certificate"
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid,issuer:always
-keyUsage = critical, digitalSignature, keyEncipherment
-extendedKeyUsage = serverAuth
-[ crl_ext ]
-# Extension for CRLs (`man x509v3_config`).
-authorityKeyIdentifier=keyid:always
-[ ocsp ]
-# Extension for OCSP signing certificates (`man ocsp`).
-basicConstraints = CA:FALSE
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid,issuer
-keyUsage = critical, digitalSignature
-extendedKeyUsage = critical, OCSPSigning

diff --git a/src/regress/lib/libcrypto/CA/Makefile b/src/regress/lib/libcrypto/CA/Makefile deleted file mode 100644 index c31c99c946..0000000000 --- a/src/regress/lib/libcrypto/CA/Makefile +++ /dev/null
@@ -1,21 +0,0 @@
1	# $OpenBSD: Makefile,v 1.1 2017/01/25 10:29:34 beck Exp $
2
3	TESTS = \
4	doit.sh
5
6	REGRESS_TARGETS= all_tests
7
8	CLEANFILES += \
9	1000.pem client.cert.pem intermediate.cert.pem root.cert.pem server.csr.pem \
10	1001.pem client.csr.pem intermediate.csr.pem root.key.pem server.key.pem \
11	chain.pem client.key.pem intermediate.key.pem server.cert.pem \
12	int.txt int.txt.attr int.txt.old int.txt.attr.old \
13	root.txt root.txt.attr root.txt.old root.txt.attr.old \
14	intserial rootserial intserial.old rootserial.old
15
16	all_tests: ${TESTS}
17	@for test in $>; do \
18	./$$test; \
19	done
20
21	.include <bsd.regress.mk>


diff --git a/src/regress/lib/libcrypto/CA/doit.sh b/src/regress/lib/libcrypto/CA/doit.sh deleted file mode 100755 index 110d89d67f..0000000000 --- a/src/regress/lib/libcrypto/CA/doit.sh +++ /dev/null
@@ -1,116 +0,0 @@
1	#!/bin/sh
2	# $OpenBSD: doit.sh,v 1.2 2018/07/17 17:06:49 tb Exp $
3
4	rm -rf root intermediate certs
5	echo 1000 > rootserial
6	cat /dev/null > root.txt
7	echo 1000 > intserial
8	cat /dev/null > int.txt
9
10	# Vanna Vanna make me a root cert
11	openssl genrsa -out root.key.pem 4096
12	if [ $? -ne 0 ]; then
13	echo "*** Fail; Can't generate root rsa 4096 key"
14	exit 1
15	fi
16
17	openssl req -batch -config root.cnf -key root.key.pem -new -x509 -days 365 -sha256 -extensions v3_ca -out root.cert.pem
18	if [ $? -ne 0 ]; then
19	echo "*** Fail; Can't generate root req"
20	exit 1
21	fi
22
23	# Make intermediate
24	openssl genrsa -out intermediate.key.pem 2048
25	if [ $? -ne 0 ]; then
26	echo "*** Fail; Can't generate intermediate rsa 2048 key"
27	exit 1
28	fi
29
30	openssl req -batch -config intermediate.cnf -new -sha256 \
31	-key intermediate.key.pem \
32	-out intermediate.csr.pem
33	if [ $? -ne 0 ]; then
34	echo "*** Fail; Can't generate intermediate req"
35	exit 1
36	fi
37
38	# Sign intermediate
39	openssl ca -batch -config root.cnf -extensions v3_intermediate_ca -days 10 -notext -md sha256 -in intermediate.csr.pem -out intermediate.cert.pem
40	if [ $? -ne 0 ]; then
41	echo "*** Fail; Can't sign intermediate"
42	exit 1
43	fi
44
45	# Verify Intermediate
46	openssl verify -CAfile ca.cert.pem intermediate.cert.pem
47	if [ $? -ne 0]; then
48	echo "*** Fail; Intermediate CA does not validate"
49	exit 1
50	fi
51
52	cat intermediate.cert.pem root.cert.pem > chain.pem
53
54	# make a server certificate
55
56	openssl genrsa -out server.key.pem 2048
57	if [ $? -ne 0]; then
58	echo "*** Fail; genrsa server"
59	exit 1
60	fi
61
62
63	openssl req -batch -config intermediate.cnf \
64	-key server.key.pem \
65	-new -sha256 -out server.csr.pem \
66	-subj '/CN=server/O=OpenBSD/OU=So and Sos/C=CA'
67	if [ $? -ne 0]; then
68	echo "*** Fail; server req"
69	exit 1
70	fi
71
72	# sign server key
73	openssl ca -batch -config intermediate.cnf -extensions server_cert -days 5 -notext -md sha256 -in server.csr.pem -out server.cert.pem
74	if [ $? -ne 0 ]; then
75	echo "*** Fail; server sign"
76	exit 1
77	fi
78
79	# make a client certificate
80
81	openssl genrsa -out client.key.pem 2048
82	if [ $? -ne 0]; then
83	echo "*** Fail; genrsa client"
84	exit 1
85	fi
86
87	openssl req -batch -config intermediate.cnf \
88	-key client.key.pem \
89	-new -sha256 -out client.csr.pem \
90	-subj '/CN=client/O=OpenBSD/OU=So and Sos/C=CA'
91	if [ $? -ne 0]; then
92	echo "*** Fail; client req"
93	exit 1
94	fi
95
96	# sign client key
97	openssl ca -batch -config intermediate.cnf -extensions usr_cert -days 5 -notext -md sha256 -in client.csr.pem -out client.cert.pem
98	if [ $? -ne 0 ]; then
99	echo "*** Fail; client sign"
100	exit 1
101	fi
102
103	# Verify Intermediate
104	openssl verify -purpose sslserver -CAfile chain.pem server.cert.pem
105	if [ $? -ne 0 ]; then
106	echo "*** Fail; server cert does not validate"
107	exit 1
108	fi
109
110	# Verify Intermediate
111	openssl verify -purpose sslclient -CAfile chain.pem client.cert.pem
112	if [ $? -ne 0 ]; then
113	echo "*** Fail; client cert does not validate"
114	exit 1
115	fi
116


diff --git a/src/regress/lib/libcrypto/CA/intermediate.cnf b/src/regress/lib/libcrypto/CA/intermediate.cnf deleted file mode 100644 index 9a95487c00..0000000000 --- a/src/regress/lib/libcrypto/CA/intermediate.cnf +++ /dev/null
@@ -1,130 +0,0 @@
1	# $OpenBSD: intermediate.cnf,v 1.2 2018/07/17 17:06:49 tb Exp $
2	# For regression tests
3	default_ca = CA_regress
4
5	[ CA_regress ]
6	# Directory and file locations.
7	dir = .
8	certs = $dir
9	crl_dir = $dir
10	database = $dir/int.txt
11	serial = $dir/intserial
12	new_certs_dir = $dir
13
14	# The root key and root certificate.
15	private_key = $dir/intermediate.key.pem
16	certificate = $dir/intermediate.cert.pem
17
18	# For certificate revocation lists.
19	crlnumber = $dir/crlnumber
20	crl = $dir/ca.crl.pem
21	crl_extensions = crl_ext
22	default_crl_days = 30
23
24	# SHA-1 is deprecated, so use SHA-2 instead.
25	default_md = sha256
26
27	name_opt = ca_default
28	cert_opt = ca_default
29	default_days = 10
30	preserve = no
31	policy = policy_loose
32
33	[ policy_strict ]
34	# The root CA should only sign intermediate certificates that match.
35	# See the POLICY FORMAT section of `man ca`.
36	countryName = match
37	stateOrProvinceName = match
38	organizationName = match
39	organizationalUnitName = optional
40	commonName = supplied
41	emailAddress = optional
42
43	[ policy_loose ]
44	# Allow the intermediate CA to sign a more diverse range of certificates.
45	# See the POLICY FORMAT section of the `ca` man page.
46	countryName = optional
47	stateOrProvinceName = optional
48	localityName = optional
49	organizationName = optional
50	organizationalUnitName = optional
51	commonName = supplied
52	emailAddress = optional
53
54	[ req ]
55	# Options for the `req` tool (`man req`).
56	default_bits = 2048
57	distinguished_name = req_distinguished_name
58	string_mask = utf8only
59
60	# SHA-1 is deprecated, so use SHA-2 instead.
61	default_md = sha256
62
63	# Extension to add when the -x509 option is used.
64	x509_extensions = v3_ca
65
66	[ req_distinguished_name ]
67	# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
68	countryName = Country Name (2 letter code)
69	stateOrProvinceName = State or Province Name
70	localityName = Locality Name
71	0.organizationName = Organization Name
72	organizationalUnitName = Organizational Unit Name
73	commonName = Common Name
74	emailAddress = Email Address
75
76	# Optionally, specify some defaults.
77	countryName_default = CA
78	stateOrProvinceName_default = Alberta
79	localityName_default = Edmonton
80	0.organizationName_default = OpenBSD
81	organizationalUnitName_default = So and Sos
82	emailAddress_default = evilsoandsos@openbsd.org
83	commonName_default = Regress Intermediate CA
84
85	[ v3_ca ]
86	# Extensions for a typical CA (`man x509v3_config`).
87	subjectKeyIdentifier = hash
88	authorityKeyIdentifier = keyid:always,issuer
89	basicConstraints = critical, CA:true
90	keyUsage = critical, digitalSignature, cRLSign, keyCertSign
91
92	[ v3_intermediate_ca ]
93	# Extensions for a typical intermediate CA (`man x509v3_config`).
94	subjectKeyIdentifier = hash
95	authorityKeyIdentifier = keyid:always,issuer
96	basicConstraints = critical, CA:true, pathlen:0
97	keyUsage = critical, digitalSignature, cRLSign, keyCertSign
98
99	[ usr_cert ]
100	# Extensions for client certificates (`man x509v3_config`).
101	basicConstraints = CA:FALSE
102	nsCertType = client, email
103	nsComment = "OpenSSL Generated Client Certificate"
104	subjectKeyIdentifier = hash
105	authorityKeyIdentifier = keyid,issuer
106	keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
107	extendedKeyUsage = clientAuth, emailProtection
108
109	[ server_cert ]
110	# Extensions for server certificates (`man x509v3_config`).
111	basicConstraints = CA:FALSE
112	nsCertType = server
113	nsComment = "OpenSSL Generated Server Certificate"
114	subjectKeyIdentifier = hash
115	authorityKeyIdentifier = keyid,issuer:always
116	keyUsage = critical, digitalSignature, keyEncipherment
117	extendedKeyUsage = serverAuth
118
119	[ crl_ext ]
120	# Extension for CRLs (`man x509v3_config`).
121	authorityKeyIdentifier=keyid:always
122
123	[ ocsp ]
124	# Extension for OCSP signing certificates (`man ocsp`).
125	basicConstraints = CA:FALSE
126	subjectKeyIdentifier = hash
127	authorityKeyIdentifier = keyid,issuer
128	keyUsage = critical, digitalSignature
129	extendedKeyUsage = critical, OCSPSigning
130


diff --git a/src/regress/lib/libcrypto/CA/root.cnf b/src/regress/lib/libcrypto/CA/root.cnf deleted file mode 100644 index b22e161476..0000000000 --- a/src/regress/lib/libcrypto/CA/root.cnf +++ /dev/null
@@ -1,130 +0,0 @@
1	# $OpenBSD: root.cnf,v 1.2 2018/07/17 17:06:49 tb Exp $
2	# For regression tests
3	default_ca = CA_regress
4
5	[ CA_regress ]
6	# Directory and file locations.
7	dir = .
8	certs = $dir
9	crl_dir = $dir
10	database = $dir/root.txt
11	serial = $dir/rootserial
12	new_certs_dir = $dir
13
14	# The root key and root certificate.
15	private_key = $dir/root.key.pem
16	certificate = $dir/root.cert.pem
17
18	# For certificate revocation lists.
19	crlnumber = $dir/crlnumber
20	crl = $dir/ca.crl.pem
21	crl_extensions = crl_ext
22	default_crl_days = 30
23
24	# SHA-1 is deprecated, so use SHA-2 instead.
25	default_md = sha256
26
27	name_opt = ca_default
28	cert_opt = ca_default
29	default_days = 375
30	preserve = no
31	policy = policy_strict
32
33	[ policy_strict ]
34	# The root CA should only sign intermediate certificates that match.
35	# See the POLICY FORMAT section of `man ca`.
36	countryName = match
37	stateOrProvinceName = match
38	organizationName = match
39	organizationalUnitName = optional
40	commonName = supplied
41	emailAddress = optional
42
43	[ policy_loose ]
44	# Allow the intermediate CA to sign a more diverse range of certificates.
45	# See the POLICY FORMAT section of the `ca` man page.
46	countryName = optional
47	stateOrProvinceName = optional
48	localityName = optional
49	organizationName = optional
50	organizationalUnitName = optional
51	commonName = supplied
52	emailAddress = optional
53
54	[ req ]
55	# Options for the `req` tool (`man req`).
56	default_bits = 2048
57	distinguished_name = req_distinguished_name
58	string_mask = utf8only
59
60	# SHA-1 is deprecated, so use SHA-2 instead.
61	default_md = sha256
62
63	# Extension to add when the -x509 option is used.
64	x509_extensions = v3_ca
65
66	[ req_distinguished_name ]
67	# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
68	countryName = Country Name (2 letter code)
69	stateOrProvinceName = State or Province Name
70	localityName = Locality Name
71	0.organizationName = Organization Name
72	organizationalUnitName = Organizational Unit Name
73	commonName = Common Name
74	emailAddress = Email Address
75
76	# Optionally, specify some defaults.
77	countryName_default = CA
78	stateOrProvinceName_default = Alberta
79	localityName_default = Edmonton
80	0.organizationName_default = OpenBSD
81	organizationalUnitName_default = So and Sos
82	emailAddress_default = evilsoandsos@openbsd.org
83	commonName_default = Regress Root CA
84
85	[ v3_ca ]
86	# Extensions for a typical CA (`man x509v3_config`).
87	subjectKeyIdentifier = hash
88	authorityKeyIdentifier = keyid:always,issuer
89	basicConstraints = critical, CA:true
90	keyUsage = critical, digitalSignature, cRLSign, keyCertSign
91
92	[ v3_intermediate_ca ]
93	# Extensions for a typical intermediate CA (`man x509v3_config`).
94	subjectKeyIdentifier = hash
95	authorityKeyIdentifier = keyid:always,issuer
96	basicConstraints = critical, CA:true, pathlen:0
97	keyUsage = critical, digitalSignature, cRLSign, keyCertSign
98
99	[ usr_cert ]
100	# Extensions for client certificates (`man x509v3_config`).
101	basicConstraints = CA:FALSE
102	nsCertType = client, email
103	nsComment = "OpenSSL Generated Client Certificate"
104	subjectKeyIdentifier = hash
105	authorityKeyIdentifier = keyid,issuer
106	keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
107	extendedKeyUsage = clientAuth, emailProtection
108
109	[ server_cert ]
110	# Extensions for server certificates (`man x509v3_config`).
111	basicConstraints = CA:FALSE
112	nsCertType = server
113	nsComment = "OpenSSL Generated Server Certificate"
114	subjectKeyIdentifier = hash
115	authorityKeyIdentifier = keyid,issuer:always
116	keyUsage = critical, digitalSignature, keyEncipherment
117	extendedKeyUsage = serverAuth
118
119	[ crl_ext ]
120	# Extension for CRLs (`man x509v3_config`).
121	authorityKeyIdentifier=keyid:always
122
123	[ ocsp ]
124	# Extension for OCSP signing certificates (`man ocsp`).
125	basicConstraints = CA:FALSE
126	subjectKeyIdentifier = hash
127	authorityKeyIdentifier = keyid,issuer
128	keyUsage = critical, digitalSignature
129	extendedKeyUsage = critical, OCSPSigning
130