]> Raphaƫl G. Git Repositories - acme/blob - acme.pm
6a17c3c04b2ab1d379a83acebf9b9775d1534b12
[acme] / acme.pm
1 # acme package
2 package acme;
3
4 # Best practice
5 use strict;
6 use warnings;
7
8 # Symbol export
9 use Exporter;
10 our @ISA = qw(Exporter);
11 our @EXPORT_OK = qw(DS CERT_DIR KEY_DIR REQUEST_CSR ACCOUNT_KEY SERVER_KEY SERVER_CRT CONFIG);
12
13 # Load dependancies
14 use Carp qw(carp confess);
15 use Data::Dumper;
16 use Date::Parse qw(str2time);
17 use Digest::SHA qw(sha256_base64);
18 use Email::Valid;
19 use File::Path qw(make_path);
20 use File::Slurp qw(read_file write_file);
21 use File::Temp; # qw( :seekable );
22 use IPC::System::Simple qw(capturex);
23 use JSON qw(encode_json decode_json);
24 use LWP;
25 use MIME::Base64 qw(encode_base64url encode_base64);
26 use Net::Domain::TLD;
27 use POSIX qw(EXIT_FAILURE);
28 use Tie::IxHash;
29
30 # Documentation links
31 #XXX: see https://letsencrypt.github.io/acme-spec/ (probably based on https://ietf-wg-acme.github.io/acme/)
32 #XXX: see jwk rfc http://www.rfc-editor.org/rfc/rfc7517.txt
33 #XXX: see javascript implementation https://github.com/diafygi/gethttpsforfree/blob/gh-pages/js/index.js
34
35 # Set constants
36 use constant {
37 # Directory separator
38 DS => '/',
39
40 # Directory for certificates
41 CERT_DIR => 'cert',
42
43 # Directory for keys
44 KEY_DIR => 'key',
45
46 # Directory for pending cache
47 PENDING_DIR => 'pending',
48
49 # Request certificate file name
50 REQUEST_CSR => 'request.der',
51
52 # Account key file name
53 ACCOUNT_KEY => 'account.pem',
54
55 # Server private key
56 SERVER_KEY => 'server.pem',
57
58 # Server public certificate
59 SERVER_CRT => 'server.crt',
60
61 # rsa
62 KEY_TYPE => 'rsa',
63
64 # 2048|4096
65 KEY_SIZE => 4096,
66
67 # Acme infos
68 ACME_CERT => 'https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem',
69 ACME_DIR => 'https://acme-staging.api.letsencrypt.org/directory',
70 ACME_PROD_DIR => 'https://acme-v01.api.letsencrypt.org/directory',
71 ACME_TERMS => 'https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf',
72
73 # Version
74 VERSION => 'v0.4',
75
76 # Config
77 CONFIG => '/etc/acmepl/config'
78 };
79
80 # User agent object
81 our $ua;
82
83 # Strerr backup
84 our $_stderr;
85
86 # JSON Web Key (JWK)
87 #XXX: tie to Tie::IxHash to keep a stable ordering of hash keys
88 #our %jwk = (
89 # pubkey => undef,
90 # jwk => {
91 # alg => 'RS256',
92 # jwk => {
93 # # Exponent
94 # e => undef,
95 # # Key type
96 # kty => uc(KEY_TYPE),
97 # # Modulus
98 # n => undef
99 # }
100 # },
101 # thumbprint => undef
102 #);
103 tie(our %jwk, 'Tie::IxHash', pubkey => undef, jwk => undef, thumbprint => undef);
104 tie(%{$jwk{jwk}}, 'Tie::IxHash', alg => 'RS256', jwk => undef);
105 #XXX: strict ordering only really needed here for thumbprint sha256 digest
106 tie(%{$jwk{jwk}{jwk}}, 'Tie::IxHash', e => undef, kty => uc(KEY_TYPE), n => undef);
107
108 # Constructor
109 sub new {
110 # Extract params
111 my ($class, $mail, $debug, $prod, @domains) = @_;
112
113 # Create self hash
114 my $self = {};
115
116 # Link self to package
117 bless($self, $class);
118
119 # Save debug
120 $self->{debug} = $debug;
121
122 # Save prod
123 $self->{prod} = $prod;
124
125 # Add extra check to mail validity
126 #XXX: mxcheck fail if there is only a A record on the domain
127 my $ev = Email::Valid->new(-fqdn => 1, -tldcheck => 1, -mxcheck => 1);
128
129 # Show error if check fail
130 if (! defined $ev->address($mail)) {
131 map { carp 'failed check: '.$_ if ($self->{debug}) } $ev->details();
132 confess 'Email::Valid->address failed';
133 }
134
135 # Save mail
136 $self->{mail} = $mail;
137
138 # Create resolver
139 my $res = new Net::DNS::Resolver();
140
141 # Check domains
142 map {
143 my $tld;
144
145 # Extract tld
146 unless (($tld) = $_ =~ m/\.(\w+)$/) {
147 confess $_.'\'s tld extraction failed';
148 }
149
150 # Check if tld exists
151 unless(Net::Domain::TLD::tld_exists($tld)) {
152 confess $tld.' tld from '.$_.' don\'t exists';
153 }
154
155 # Check if we get dns answer
156 #XXX: only search A type because letsencrypt don't support ipv6 (AAAA) yet
157 unless(my $rep = $res->search($_, 'A')) {
158 confess 'search A record for '.$_.' failed';
159 } else {
160 unless (scalar map { $_->type eq 'A' ? 1 : (); } $rep->answer) {
161 confess 'search recursively A record for '.$_.' failed';
162 }
163 }
164 } @domains;
165
166 # Save domains
167 @{$self->{domains}} = @domains;
168
169 # Return class reference
170 return $self;
171 }
172
173 # Prepare environement
174 sub prepare {
175 my ($self) = @_;
176
177 # Create all paths
178 make_path(CERT_DIR, KEY_DIR, PENDING_DIR.'/'.$self->{mail}.'.'.($self->{prod} ? 'prod' : 'staging'), {error => \my $err});
179 if (@$err) {
180 map {
181 my ($file, $msg) = %$_;
182 carp ($file eq '' ? '' : $file.': ').$msg if ($self->{debug});
183 } @$err;
184 confess 'make_path failed';
185 }
186
187 # Create user agent
188 $ua = LWP::UserAgent->new;
189 $ua->agent(__PACKAGE__.'/'.VERSION)
190 }
191
192 # Drop stderr
193 sub _dropStdErr {
194 # Save stderr
195 open($_stderr, '>&STDERR') or die $!;
196 # Close it
197 close(STDERR) or die $!;
198 # Send to /dev/null
199 open(STDERR, '>', '/dev/null') or die $!;
200 }
201
202 # Restore stderr
203 sub _restoreStdErr {
204 # Close stderr
205 close(STDERR);
206 # Open it back
207 open(STDERR, '>&', $_stderr) or die $!;
208 }
209
210 # Generate required keys
211 sub genKeys {
212 my ($self) = @_;
213
214 # Generate account and server key if required
215 map {
216 # Check key existence
217 if (! -f $_) {
218 # Drop stderr
219 _dropStdErr();
220 # Generate key
221 #XXX: we drop stderr here because openssl can't be quiet on this command
222 capturex('openssl', ('genrsa', '-out', $_, KEY_SIZE));
223 # Restore stderr
224 _restoreStdErr();
225 }
226 } (KEY_DIR.DS.ACCOUNT_KEY, KEY_DIR.DS.SERVER_KEY);
227
228 # Extract modulus and publicExponent jwk
229 #XXX: same here we tie to keep ordering
230 tie(%{$self->{account}}, 'Tie::IxHash', %jwk);
231 map {
232 if (/^Modulus=([0-9A-F]+)$/) {
233 # Extract to binary from hex and convert to base64 url
234 $self->{account}{jwk}{jwk}{n} = encode_base64url(pack("H*", $1) =~ s/^\0+//r);
235 } elsif (/^publicExponent:\s([0-9]+)\s\(0x[0-1]+\)$/) {
236 # Extract to binary from int, trim leading zeros and convert to base64 url
237 chomp ($self->{account}{jwk}{jwk}{e} = encode_base64url(pack("N", $1) =~ s/^\0+//r));
238 }
239 } capturex('openssl', ('rsa', '-text', '-in', KEY_DIR.DS.ACCOUNT_KEY, '-noout', '-modulus'));
240
241 # Drop stderr
242 _dropStdErr();
243 # Extract account public key
244 $self->{account}{pubkey} = join('', map { chomp; $_; } capturex('openssl', ('rsa', '-in', KEY_DIR.DS.ACCOUNT_KEY, '-pubout')));
245 # Restore stderr
246 _restoreStdErr();
247
248 # Store thumbprint
249 #XXX: convert base64 to base64 url
250 $self->{account}{thumbprint} = (sha256_base64(encode_json($self->{account}{jwk}{jwk})) =~ s/=+\z//r) =~ tr[+/][-_]r;
251 }
252
253 # Generate certificate request
254 sub genCsr {
255 my ($self) = @_;
256
257 # Openssl config template
258 my $oct = File::Temp->new();
259
260 # Load template from data
261 map { s/__EMAIL_ADDRESS__/$self->{mail}/; s/__COMMON_NAME__/$self->{domains}[0]/; print $oct $_; } <DATA>;
262
263 # Close data
264 close(DATA);
265
266 # Append domain names
267 my $i = 1;
268 map { print $oct 'DNS.'.$i++.' = '.$_."\n"; } @{$self->{domains}};
269
270 # Generate csr
271 capturex('openssl', ('req', '-new', '-outform', 'DER', '-key', KEY_DIR.DS.SERVER_KEY, '-config', $oct->filename, '-out', CERT_DIR.DS.REQUEST_CSR));
272
273 # Close oct
274 close($oct);
275 }
276
277 # Directory call
278 sub directory {
279 my ($self) = @_;
280
281 # Set time
282 my $time = time;
283
284 # Set directory
285 my $dir = $self->{prod} ? ACME_PROD_DIR : ACME_DIR;
286
287 # Create a request
288 my $req = HTTP::Request->new(GET => $dir.'?'.$time);
289
290 # Get request
291 my $res = $ua->request($req);
292
293 # Handle error
294 unless ($res->is_success) {
295 confess 'GET '.$dir.'?'.$time.' failed: '.$res->status_line;
296 }
297
298 # Save nonce
299 $self->{nonce} = $res->headers->{'replay-nonce'};
300
301 # Merge uris in self content
302 %$self = (%$self, %{decode_json($res->content)});
303 }
304
305 # Post request
306 sub _post {
307 my ($self, $uri, $payload) = @_;
308
309 # Protected field
310 my $protected = encode_base64url(encode_json({nonce => $self->{nonce}}));
311
312 # Payload field
313 $payload = encode_base64url(encode_json($payload));
314
315 # Sign temp file
316 my $stf = File::Temp->new();
317
318 # Append protect.payload to stf
319 print $stf $protected.'.'.$payload;
320
321 # Close stf
322 close($stf);
323
324 # Generate digest of stf
325 my $signature = encode_base64url(join('', capturex('openssl', ('dgst', '-sha256', '-binary', '-sign', KEY_DIR.DS.ACCOUNT_KEY, $stf->filename))) =~ s/^\0+//r);
326
327 # Create a request
328 my $req = HTTP::Request->new(POST => $uri);
329
330 # Set new-reg request content
331 $req->content(encode_json({
332 header => $self->{account}{jwk},
333 protected => $protected,
334 payload => $payload,
335 signature => $signature
336 }));
337
338 # Post request
339 my $res = $ua->request($req);
340
341 # Save nonce
342 if (defined $res->headers->{'replay-nonce'}) {
343 $self->{nonce} = $res->headers->{'replay-nonce'};
344 }
345
346 # Return res object
347 return $res;
348 }
349
350 # Resolve dns and check content
351 #XXX: see https://community.centminmod.com/threads/looks-like-letsencrypt-dns-01-is-ready.5845/#12 for example
352 sub _dnsCheck {
353 my ($self, $domain, $token) = @_;
354
355 # Generate signature from content
356 my $signature = ((sha256_base64($token.'.'.$self->{account}{thumbprint})) =~ s/=+\z//r) =~ tr[+/][-_]r;
357
358 # Fix domain
359 $domain = '_acme-challenge.'.$domain.'.';
360
361 # Create resolver
362 my $res = new Net::DNS::Resolver();
363
364 # Check if we get dns answer
365 unless(my $rep = $res->search($domain, 'TXT')) {
366 carp 'TXT record search for '.$domain.' failed' if ($self->{debug});
367 return;
368 } else {
369 unless (scalar map { $_->type eq 'TXT' && $_->txtdata =~ /^$signature$/ ? 1 : (); } $rep->answer) {
370 carp 'TXT record recursive search for '.$domain.' failed' if ($self->{debug});
371 return;
372 }
373 }
374
375 return 1;
376 }
377
378 # Get uri and check content
379 sub _httpCheck {
380 my ($self, $domain, $token) = @_;
381
382 # Create a request
383 my $req = HTTP::Request->new(GET => 'http://'.$domain.'/.well-known/acme-challenge/'.$token);
384
385 # Load config if available
386 my $config = undef;
387 if (
388 #XXX: use eval to workaround a fatal in decode_json
389 defined eval {
390 # Check that file exists
391 -f CONFIG &&
392 # Read it
393 ($config = read_file(CONFIG)) &&
394 # Decode it
395 ($config = decode_json($config)) &&
396 # Check defined
397 $config->{thumbprint}
398 }
399 ) {
400 # Try to write thumbprint
401 write_file($config->{thumbprint}, $self->{account}{thumbprint});
402 }
403
404 # Get request
405 my $res = $ua->request($req);
406
407 # Handle error
408 unless ($res->is_success) {
409 carp 'GET http://'.$domain.'/.well-known/acme-challenge/'.$token.' failed: '.$res->status_line if ($self->{debug});
410 return;
411 }
412
413 # Handle invalid content
414 unless($res->content =~ /^$token.$self->{account}{thumbprint}\s*$/) {
415 carp 'GET http://'.$domain.'/.well-known/acme-challenge/'.$token.' content match failed: /^'.$token.'.'.$self->{account}{thumbprint}.'\s*$/ !~ '.$res->content if ($self->{debug});
416 return;
417 }
418
419 # Return success
420 return 1;
421 }
422
423 # Register account
424 #XXX: see doc at https://ietf-wg-acme.github.io/acme/#rfc.section.6.3
425 sub register {
426 my ($self) = @_;
427
428 # Post new-reg request
429 #XXX: contact array may contain a tel:+33612345678 for example
430 my $res = $self->_post($self->{'new-reg'}, {resource => 'new-reg', contact => ['mailto:'.$self->{mail}], agreement => ACME_TERMS});
431
432 # Handle error
433 unless ($res->is_success || $res->code eq 409) {
434 confess 'POST '.$self->{'new-reg'}.' failed: '.$res->status_line;
435 }
436
437 # Update mail informations
438 if ($res->code eq 409) {
439 # Save registration uri
440 $self->{'reg'} = $res->headers->{location};
441
442 # Post reg request
443 #XXX: contact array may contain a tel:+33612345678 for example
444 $res = $self->_post($self->{'reg'}, {resource => 'reg', contact => ['mailto:'.$self->{mail}]});
445
446 # Handle error
447 unless ($res->is_success) {
448 confess 'POST '.$self->{'reg'}.' failed: '.$res->status_line;
449 }
450 }
451 }
452
453 # Authorize domains
454 sub authorize {
455 my ($self) = @_;
456
457 # Create challenges hash
458 %{$self->{challenges}} = ();
459
460 # Pending list
461 my @pending = ();
462
463 # Create or load auth request for each domain
464 map {
465 # Init content
466 my $content = undef;
467
468 # Init file
469 my $file = PENDING_DIR.'/'.$self->{mail}.'.'.($self->{prod} ? 'prod' : 'staging').'/'.$_;
470
471 # Load auth request content or post a new one
472 #TODO: add more check on cache file ???
473 if (
474 #XXX: use eval to workaround a fatal in decode_json
475 ! defined eval {
476 # Check that file exists
477 -f $file &&
478 # Read it
479 ($content = read_file($file)) &&
480 # Decode it
481 ($content = decode_json($content))
482 # Check expiration
483 } || (str2time($content->{expires}) <= time()+3600)
484 ) {
485 # Post new-authz request
486 my $res = $self->_post($self->{'new-authz'}, {resource => 'new-authz', identifier => {type => 'dns', value => $_}, existing => 'accept'});
487
488 # Handle error
489 unless ($res->is_success) {
490 confess 'POST '.$self->{'new-authz'}.' for '.$_.' failed: '.$res->status_line;
491 }
492
493 # Decode content
494 $content = decode_json($res->content);
495
496 # Check domain
497 unless (defined $content->{identifier}{value} && $content->{identifier}{value} eq $_) {
498 confess 'domain matching '.$content->{identifier}{value}.' for '.$_.' failed: '.$res->status_line;
499 }
500
501 # Check status
502 unless ($content->{status} eq 'valid' or $content->{status} eq 'pending') {
503 confess 'POST '.$self->{'new-authz'}.' for '.$_.' failed: '.$res->status_line;
504 }
505
506 # Write to file
507 write_file($file, encode_json($content));
508 }
509
510 # Add challenge
511 %{$self->{challenges}{$_}} = (
512 status => $content->{status},
513 expires => $content->{expires},
514 polls => []
515 );
516
517 # Save pending data
518 if ($content->{status} eq 'pending') {
519 # Extract validation data
520 foreach my $challenge (@{$content->{challenges}}) {
521 # One test already validated this auth request
522 if ($self->{challenges}{$_}{status} eq 'valid') {
523 next;
524 } elsif ($challenge->{status} eq 'valid') {
525 $self->{challenges}{$_}{status} = $challenge->{status};
526 next;
527 } elsif ($challenge->{status} eq 'pending') {
528 # Handle check
529 if (
530 ($challenge->{type} =~ /^http-01$/ and $self->_httpCheck($_, $challenge->{token})) or
531 ($challenge->{type} =~ /^dns-01$/ and $self->_dnsCheck($_, $challenge->{token}))
532 ) {
533 # Post challenge request
534 my $res = $self->_post($challenge->{uri}, {resource => 'challenge', keyAuthorization => $challenge->{token}.'.'.$self->{account}{thumbprint}});
535
536 # Handle error
537 unless ($res->is_success) {
538 confess 'POST '.$challenge->{uri}.' failed: '.$res->status_line;
539 }
540
541 # Extract content
542 my $content = decode_json($res->content);
543
544 # Save if valid
545 if ($content->{status} eq 'valid') {
546 $self->{challenges}{$_}{status} = $content->{status};
547 # Check is still polling
548 } elsif ($content->{status} eq 'pending') {
549 # Add to poll list for later use
550 push(@{$self->{challenges}{$_}{polls}}, {
551 type => (split(/-/, $challenge->{type}))[0],
552 status => $content->{status},
553 poll => $content->{uri}
554 });
555 }
556 }
557 }
558 }
559 # Check if check is challenge still in pending and no polls
560 if ($self->{challenges}{$_}{status} eq 'pending' && scalar @{$self->{challenges}{$_}{polls}} == 0) {
561 # Loop on all remaining challenges
562 foreach my $challenge (@{$content->{challenges}}) {
563 # Display help for http-01 check
564 if ($challenge->{type} eq 'http-01') {
565 print STDERR 'Create URI http://'.$_.'/.well-known/acme-challenge/'.$challenge->{token}.' with content '.$challenge->{token}.'.'.$self->{account}{thumbprint}."\n";
566 # Display help for dns-01 check
567 } elsif ($challenge->{type} eq 'dns-01') {
568 print STDERR 'Create TXT record _acme-challenge.'.$_.'. with value '.(((sha256_base64($challenge->{token}.'.'.$self->{account}{thumbprint})) =~ s/=+\z//r) =~ tr[+/][-_]r)."\n";
569 }
570 }
571 }
572 }
573 } @{$self->{domains}};
574
575 # Init max run
576 my $remaining = 10;
577
578 # Poll pending
579 while (--$remaining >= 0 and scalar map { $_->{status} eq 'valid' ? 1 : (); } values %{$self->{challenges}}) {
580 # Sleep
581 sleep(1);
582 # Poll remaining pending
583 map {
584 # Init domain
585 my $domain = $_;
586
587 # Poll remaining polls
588 map {
589 # Create a request
590 my $req = HTTP::Request->new(GET => $_->{poll});
591
592 # Get request
593 my $res = $ua->request($req);
594
595 # Handle error
596 unless ($res->is_success) {
597 carp 'GET '.$self->{challenges}{$_}{http_challenge}.' failed: '.$res->status_line if ($self->{debug});
598 }
599
600 # Extract content
601 my $content = decode_json($res->content);
602
603 # Save status
604 if ($content->{status} ne 'pending') {
605 $self->{challenges}{$domain}{status} = $content->{status};
606 }
607 } @{$self->{challenges}{$_}{polls}};
608 } map { $self->{challenges}{$_}{status} eq 'pending' ? $_ : (); } keys %{$self->{challenges}};
609 }
610
611 # Load config if available
612 my $config = undef;
613 if (
614 #XXX: use eval to workaround a fatal in decode_json
615 defined eval {
616 # Check that file exists
617 -f CONFIG &&
618 # Read it
619 ($config = read_file(CONFIG)) &&
620 # Decode it
621 ($config = decode_json($config)) &&
622 # Check defined
623 $config->{thumbprint}
624 }
625 ) {
626 # Try to write thumbprint
627 write_file($config->{thumbprint}, '');
628 }
629
630 # Stop here with remaining chanllenge
631 if (scalar map { ! defined $_->{status} or $_->{status} ne 'valid' ? 1 : (); } values %{$self->{challenges}}) {
632 # Deactivate all activated domains
633 #XXX: not implemented by letsencrypt
634 #map {
635 # # Post deactivation request
636 # my $res = $self->_post($self->{challenges}{$_}{http_uri}, {resource => 'authz', status => 'deactivated'});
637 # # Handle error
638 # unless ($res->is_success) {
639 # print Dumper($res);
640 # confess 'POST '.$self->{challenges}{$_}{http_uri}.' failed: '.$res->status_line;
641 # }
642 #} map { $self->{challenges}{$_}{status} eq 'valid' ? $_ : () } keys %{$self->{challenges}};
643
644 # Stop here as a domain of csr list failed authorization
645 if ($self->{debug}) {
646 my @domains = map { ! defined $self->{challenges}{$_}{status} or $self->{challenges}{$_}{status} ne 'valid' ? $_ : (); } keys %{$self->{challenges}};
647 confess 'Fix the challenge'.(scalar @domains > 1?'s':'').' for domain'.(scalar @domains > 1?'s':'').': '.join(', ', @domains);
648 } else {
649 exit EXIT_FAILURE;
650 }
651 }
652 }
653
654 # Issue certificate
655 sub issue {
656 my ($self) = @_;
657
658 # Open csr file
659 open(my $fh, '<', CERT_DIR.DS.REQUEST_CSR) or die $!;
660
661 # Load csr
662 my $csr = encode_base64url(join('', <$fh>) =~ s/^\0+//r);
663
664 # Close csr file
665 close($fh) or die $!;
666
667 # Post certificate request
668 my $res = $self->_post($self->{'new-cert'}, {resource => 'new-cert', csr => $csr});
669
670 # Handle error
671 unless ($res->is_success) {
672 #print Dumper($res);
673 confess 'POST '.$self->{'new-cert'}.' failed: '.$res->status_line;
674 }
675
676 # Open crt file
677 open($fh, '>', CERT_DIR.DS.SERVER_CRT) or die $!;
678
679 # Convert to pem
680 print $fh '-----BEGIN CERTIFICATE-----'."\n".encode_base64($res->content).'-----END CERTIFICATE-----'."\n";
681
682 # Create a request
683 my $req = HTTP::Request->new(GET => ACME_CERT);
684
685 # Get request
686 $res = $ua->request($req);
687
688 # Handle error
689 unless ($res->is_success) {
690 carp 'GET '.ACME_CERT.' failed: '.$res->status_line if ($self->{debug});
691 }
692
693 # Append content
694 print $fh $res->content;
695
696 # Close file
697 close($fh) or die $!;
698
699 # Print success
700 carp 'Success, pem certificate in '.CERT_DIR.DS.SERVER_CRT if ($self->{debug});
701 }
702
703 1;
704
705 __DATA__
706 #
707 # OpenSSL configuration file.
708 # This is mostly being used for generation of certificate requests.
709 #
710
711 [ req ]
712 default_bits = 2048
713 default_md = sha256
714 prompt = no
715 distinguished_name = req_distinguished_name
716 # The extentions to add to the self signed cert
717 x509_extensions = v3_ca
718 # The extensions to add to a certificate request
719 req_extensions = v3_req
720
721 # This sets a mask for permitted string types. There are several options.
722 # utf8only: only UTF8Strings (PKIX recommendation after 2004).
723 # WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
724 string_mask = utf8only
725
726 [ req_distinguished_name ]
727 countryName = US
728 stateOrProvinceName = State or Province Name
729 localityName = Locality Name
730 organizationName = Organization Name
731 organizationalUnitName = Organizational Unit Name
732 commonName = __COMMON_NAME__
733 emailAddress = __EMAIL_ADDRESS__
734
735 [ v3_req ]
736 basicConstraints = CA:false
737 keyUsage = nonRepudiation, digitalSignature, keyEncipherment
738 subjectAltName = email:move
739 subjectAltName = @alt_names
740
741 [ v3_ca ]
742 subjectKeyIdentifier = hash
743 authorityKeyIdentifier = keyid:always,issuer
744 basicConstraints = CA:true
745
746 [alt_names]