You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
62 lines
1.4 KiB
62 lines
1.4 KiB
[ kdc_cert ]
|
|
basicConstraints=CA:FALSE
|
|
|
|
# Here are some examples of the usage of nsCertType. If it is omitted
|
|
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
|
|
|
|
#Pkinit EKU
|
|
extendedKeyUsage = 1.3.6.1.5.2.3.5
|
|
|
|
subjectKeyIdentifier=hash
|
|
authorityKeyIdentifier=keyid,issuer
|
|
|
|
# Copy subject details
|
|
|
|
issuerAltName=issuer:copy
|
|
|
|
# Add id-pkinit-san (pkinit subjectAlternativeName)
|
|
subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:kdc_princ_name
|
|
|
|
[kdc_princ_name]
|
|
realm = EXP:0, GeneralString:@@@REALM_UCNAME@@@
|
|
principal_name = EXP:1, SEQUENCE:kdc_principal_seq
|
|
|
|
[kdc_principal_seq]
|
|
name_type = EXP:0, INTEGER:1
|
|
name_string = EXP:1, SEQUENCE:kdc_principals
|
|
|
|
[kdc_principals]
|
|
princ1 = GeneralString:krbtgt
|
|
princ2 = GeneralString:@@@REALM_UCNAME@@@
|
|
|
|
[ client_cert ]
|
|
|
|
# These extensions are added when 'ca' signs a request.
|
|
|
|
basicConstraints=CA:FALSE
|
|
|
|
keyUsage = digitalSignature, keyEncipherment, keyAgreement
|
|
|
|
extendedKeyUsage = 1.3.6.1.5.2.3.4
|
|
subjectKeyIdentifier=hash
|
|
authorityKeyIdentifier=keyid,issuer
|
|
|
|
|
|
subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:princ_name
|
|
|
|
|
|
# Copy subject details
|
|
|
|
issuerAltName=issuer:copy
|
|
|
|
[princ_name]
|
|
realm = EXP:0, GeneralString:@@@REALM_UCNAME@@@
|
|
principal_name = EXP:1, SEQUENCE:principal_seq
|
|
|
|
[principal_seq]
|
|
name_type = EXP:0, INTEGER:1
|
|
name_string = EXP:1, SEQUENCE:principals
|
|
|
|
[principals]
|
|
princ1 = GeneralString:@@@KDCSERVER@@@
|