diff options
| author | Bob Beck <beck@cvs.openbsd.org> | 2001-04-17 19:55:20 +0000 |
|---|---|---|
| committer | Bob Beck <beck@cvs.openbsd.org> | 2001-04-17 19:55:20 +0000 |
| commit | 7d0500737460926be52a8b0b54186d6c90e0d710 (patch) | |
| tree | 6e80ddcf1f3f19c19ce1256697334245c5decb5a /lib/libssl | |
| parent | c9314b478c525e0ab95917d9ca82d3ec4d0572d5 (diff) | |
Add an x509v3.cnf in /etc/ssl so that creating certificate authorities
form isakmpd works. From Tim Newsham <newsham@lava.net>
ok provos@
Diffstat (limited to 'lib/libssl')
| -rw-r--r-- | lib/libssl/Makefile.bsd-wrapper | 6 | ||||
| -rw-r--r-- | lib/libssl/x509v3.cnf | 19 |
2 files changed, 23 insertions, 2 deletions
diff --git a/lib/libssl/Makefile.bsd-wrapper b/lib/libssl/Makefile.bsd-wrapper index 6061ab86716..5aee2465f3f 100644 --- a/lib/libssl/Makefile.bsd-wrapper +++ b/lib/libssl/Makefile.bsd-wrapper @@ -1,5 +1,5 @@ # Build wrapper for OpenSSL -# $OpenBSD: Makefile.bsd-wrapper,v 1.34 2001/03/09 23:06:57 deraadt Exp $ +# $OpenBSD: Makefile.bsd-wrapper,v 1.35 2001/04/17 19:55:19 beck Exp $ # Our lndir is hacked; specify a full path to avoid potential conflicts # with the one installed with X11. @@ -588,7 +588,9 @@ tags: distribution: ${INSTALL} ${INSTALL_COPY} -g ${BINGRP} -m 444 \ - ${.CURDIR}/openssl.cnf ${DESTDIR}/etc/ssl/openssl.cnf + ${.CURDIR}/openssl.cnf ${DESTDIR}/etc/ssl/openssl.cnf && \ + ${INSTALL} ${INSTALL_COPY} -g ${BINGRP} -m 444 \ + ${.CURDIR}/x509v3.cnf ${DESTDIR}/etc/ssl/x509v3.cnf .include <bsd.obj.mk> .include <bsd.subdir.mk> diff --git a/lib/libssl/x509v3.cnf b/lib/libssl/x509v3.cnf new file mode 100644 index 00000000000..f1e3c741bcb --- /dev/null +++ b/lib/libssl/x509v3.cnf @@ -0,0 +1,19 @@ +# default settings +CERTPATHLEN = 1 +CERTUSAGE = digitalSignature,keyCertSign +CERTIP = 0.0.0.0 + +# This section should be referenced when building an x509v3 CA +# Certificate. +# The default path length and the key usage can be overriden +# modified by setting the CERTPATHLEN and CERTUSAGE environment +# variables. +[x509v3_CA] +basicConstraints=critical,CA:true,pathlen:$ENV::CERTPATHLEN +keyUsage=$ENV::CERTUSAGE + +# This section should be referenced to add an IP Address +# as an alternate subject name, needed by isakmpd +# The address must be provided in the CERTIP environment variable +[x509v3_IPAddr] +subjectAltName=IP:$ENV::CERTIP |