I'm reading this and it has the below (excerpt).

# Certificate Authority Section
[ ca ]
default_ca              = CA_default                   # The default CA section

# Default CA configuration to sign a Certificate (Public Key)
[ CA_default ]
dir                     = $ENV::CADIR                  # Where everything is kept
certs                   = $dir/certs                   # Where the issued certs are kept
crl_dir                 = $dir/crl                     # Where the issued CRL are kept
database                = $dir/index.txt               # Database index file

private_key             = $dir/private/root_ca_private_key.pem # The CA Private key
RANDFILE                = $dir/private/.rand           # Private random number file
x509_extensions         = sub_ca_cert                  # The extentions to add to the 
                                                       # certificate (Public Key)
name_opt                = ca_default                   # Subject Name options
cert_opt                = ca_default                   # Certificate field options
crl_extensions          = crl_ext                      # Certificate Revocation List (CRL) exstensions
default_days            = 2920                         # How long to certify for (8 years)

At the line below, is the ca_default the same as CA_default above?

name_opt                = ca_default                   # Subject Name options
  • NO. The value of [ca]default_CA is a section name; you can use any name you want as long as the item and the section match. The values of [?]name_opt,cert_opt are not section names, they are strings like those passed to -nameopt and -certopt in x509 and only the values defined by the code can be used. This is more like copy_extensions: the value of that can be none or copy or copyall, but it can't be purple because there is no feature to copy (or even identify) purple extensions. Sep 2, 2023 at 6:14


You must log in to answer this question.

Browse other questions tagged .