584 lines
25 KiB
HTML
Executable File
584 lines
25 KiB
HTML
Executable File
<?xml version="1.0" ?>
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<title>config</title>
|
|
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
|
<link rev="made" href="mailto:root@localhost" />
|
|
</head>
|
|
|
|
<body style="background-color: white">
|
|
|
|
|
|
<!-- INDEX BEGIN -->
|
|
<div name="index">
|
|
<p><a name="__index__"></a></p>
|
|
|
|
<ul>
|
|
|
|
<li><a href="#name">NAME</a></li>
|
|
<li><a href="#description">DESCRIPTION</a></li>
|
|
<li><a href="#pragmas">PRAGMAS</a></li>
|
|
<li><a href="#openssl_library_configuration">OPENSSL LIBRARY CONFIGURATION</a></li>
|
|
<ul>
|
|
|
|
<li><a href="#asn1_object_configuration_module">ASN1 Object Configuration Module</a></li>
|
|
<li><a href="#engine_configuration_module">Engine Configuration Module</a></li>
|
|
<li><a href="#provider_configuration_module">Provider Configuration Module</a></li>
|
|
<li><a href="#evp_configuration_module">EVP Configuration Module</a></li>
|
|
<li><a href="#ssl_configuration_module">SSL Configuration Module</a></li>
|
|
</ul>
|
|
|
|
<li><a href="#notes">NOTES</a></li>
|
|
<li><a href="#examples">EXAMPLES</a></li>
|
|
<li><a href="#environment">ENVIRONMENT</a></li>
|
|
<li><a href="#bugs">BUGS</a></li>
|
|
<li><a href="#history">HISTORY</a></li>
|
|
<li><a href="#see_also">SEE ALSO</a></li>
|
|
<li><a href="#copyright">COPYRIGHT</a></li>
|
|
</ul>
|
|
|
|
<hr name="index" />
|
|
</div>
|
|
<!-- INDEX END -->
|
|
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="name">NAME</a></h1>
|
|
<p>config - OpenSSL CONF library configuration files</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="description">DESCRIPTION</a></h1>
|
|
<p>The OpenSSL CONF library can be used to read configuration files.
|
|
It is used for the OpenSSL master configuration file <strong>openssl.cnf</strong>
|
|
and in a few other places like <strong>SPKAC</strong> files and certificate extension
|
|
files for the <strong>x509</strong> utility. OpenSSL applications can also use the
|
|
CONF library for their own purposes.</p>
|
|
<p>A configuration file is divided into a number of sections. Each section
|
|
starts with a line <code>[section_name]</code> and ends when a new section is
|
|
started or end of file is reached. A section name can consist of
|
|
alphanumeric characters and underscores. The brackets are required.</p>
|
|
<p>The first section of a configuration file is special and is referred
|
|
to as the <strong>default</strong> section. This section is usually unnamed and spans from the
|
|
start of file until the first named section. When a name is being looked up
|
|
it is first looked up in a named section (if any) and then the
|
|
default section.</p>
|
|
<p>The environment is mapped onto a section called <strong>ENV</strong>.</p>
|
|
<p>Comments can be included by preceding them with the <strong>#</strong> character</p>
|
|
<p>Other files can be included using the <strong>.include</strong> directive followed
|
|
by a path. If the path points to a directory all files with
|
|
names ending with <strong>.cnf</strong> or <strong>.conf</strong> are included from the directory.
|
|
Recursive inclusion of directories from files in such directory is not
|
|
supported. That means the files in the included directory can also contain
|
|
<strong>.include</strong> directives but only inclusion of regular files is supported
|
|
there. The inclusion of directories is not supported on systems without
|
|
POSIX IO support.</p>
|
|
<p>It is strongly recommended to use absolute paths with the <strong>.include</strong>
|
|
directive. Relative paths are evaluated based on the application current
|
|
working directory so unless the configuration file containing the
|
|
<strong>.include</strong> directive is application specific the inclusion will not
|
|
work as expected. The environment variable <strong>OPENSSL_CONF_INCLUDE</strong> can also be
|
|
used to specify the path to prepend to all .include paths.</p>
|
|
<p>There can be optional <strong>=</strong> character and whitespace characters between
|
|
<strong>.include</strong> directive and the path which can be useful in cases the
|
|
configuration file needs to be loaded by old OpenSSL versions which do
|
|
not support the <strong>.include</strong> syntax. They would bail out with error
|
|
if the <strong>=</strong> character is not present but with it they just ignore
|
|
the include.</p>
|
|
<p>Pragmas can be specified with the <strong>.pragma</strong> directive.
|
|
See <a href="#pragmas">PRAGMAS</a> for more information.</p>
|
|
<p>Each section in a configuration file consists of a number of name and
|
|
value pairs of the form <strong>name=value</strong></p>
|
|
<p>The <strong>name</strong> string can contain any alphanumeric characters as well as
|
|
a few punctuation symbols such as <strong>.</strong> <strong>,</strong> <strong>;</strong> and <strong>_</strong>.</p>
|
|
<p>The <strong>value</strong> string consists of the string following the <strong>=</strong> character
|
|
until end of line with any leading and trailing white space removed.</p>
|
|
<p>The value string undergoes variable expansion. This can be done by
|
|
including the form <strong>$var</strong> or <strong>${var}</strong>: this will substitute the value
|
|
of the named variable in the current section. It is also possible to
|
|
substitute a value from another section using the syntax <strong>$section::name</strong>
|
|
or <strong>${section::name}</strong>. By using the form <strong>$ENV::name</strong> environment
|
|
variables can be substituted. It is also possible to assign values to
|
|
environment variables by using the name <strong>ENV::name</strong>, this will work
|
|
if the program looks up environment variables using the <strong>CONF</strong> library
|
|
instead of calling <code>getenv()</code> directly. The value string must not exceed 64k in
|
|
length after variable expansion. Otherwise an error will occur.</p>
|
|
<p>It is possible to escape certain characters by using any kind of quote
|
|
or the <strong>\</strong> character. By making the last character of a line a <strong>\</strong>
|
|
a <strong>value</strong> string can be spread across multiple lines. In addition
|
|
the sequences <strong>\n</strong>, <strong>\r</strong>, <strong>\b</strong> and <strong>\t</strong> are recognized.</p>
|
|
<p>All expansion and escape rules as described above that apply to <strong>value</strong>
|
|
also apply to the path of the <strong>.include</strong> directive.</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="pragmas">PRAGMAS</a></h1>
|
|
<p>Pragmas can be used to change the behavior of the configuration file
|
|
parser, among others. Currently supported pragmas are:</p>
|
|
<dl>
|
|
<dt><strong><a name="pragma_dollarid_value" class="item"><strong>.pragma</strong> <strong>dollarid</strong>:<em>value</em></a></strong></dt>
|
|
|
|
<dd>
|
|
<p><em>value</em> can be one of:</p>
|
|
<dl>
|
|
<dt><strong><a name="on_or_true" class="item"><strong>"on"</strong> or <strong>"true"</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>this signifies that dollar signs are considered an identity character
|
|
from this point on and that variable expansion requires the use of
|
|
braces or parentheses. In other words, <code>foo$bar</code> will be considered
|
|
a name instead of <code>foo</code> followed by the expansion of the variable
|
|
<code>bar</code>.
|
|
This is suitable for platforms where the dollar sign is commonly used
|
|
as part of names.</p>
|
|
</dd>
|
|
<dt><strong><a name="off_or_false" class="item"><strong>"off"</strong> or <strong>"false"</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>Turns this pragma off, i.e. <code>foo$bar</code> will be interpreted as <code>foo</code>
|
|
followed by the expansion of the variable <code>bar</code>.</p>
|
|
</dd>
|
|
</dl>
|
|
<p>By default, this pragma is turned off.</p>
|
|
</dd>
|
|
</dl>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="openssl_library_configuration">OPENSSL LIBRARY CONFIGURATION</a></h1>
|
|
<p>Applications can automatically configure certain
|
|
aspects of OpenSSL using the master OpenSSL configuration file, or optionally
|
|
an alternative configuration file. The <strong>openssl</strong> utility includes this
|
|
functionality: any sub command uses the master OpenSSL configuration file
|
|
unless an option is used in the sub command to use an alternative configuration
|
|
file.</p>
|
|
<p>To enable library configuration the default section needs to contain an
|
|
appropriate line which points to the main configuration section. The default
|
|
name is <strong>openssl_conf</strong> which is used by the <strong>openssl</strong> utility. Other
|
|
applications may use an alternative name such as <strong>myapplication_conf</strong>.
|
|
All library configuration lines appear in the default section at the start
|
|
of the configuration file.</p>
|
|
<p>The configuration section should consist of a set of name value pairs which
|
|
contain specific module configuration information. The <strong>name</strong> represents
|
|
the name of the <em>configuration module</em>. The meaning of the <strong>value</strong> is
|
|
module specific: it may, for example, represent a further configuration
|
|
section containing configuration module specific information. E.g.:</p>
|
|
<pre>
|
|
# This must be in the default section
|
|
openssl_conf = openssl_init</pre>
|
|
<pre>
|
|
[openssl_init]</pre>
|
|
<pre>
|
|
oid_section = new_oids
|
|
engines = engine_section
|
|
providers = provider_section</pre>
|
|
<pre>
|
|
[new_oids]</pre>
|
|
<pre>
|
|
... new oids here ...</pre>
|
|
<pre>
|
|
[engine_section]</pre>
|
|
<pre>
|
|
... engine stuff here ...</pre>
|
|
<pre>
|
|
[provider_section]</pre>
|
|
<pre>
|
|
... provider stuff here ...</pre>
|
|
<p>The features of each configuration module are described below.</p>
|
|
<p>
|
|
</p>
|
|
<h2><a name="asn1_object_configuration_module">ASN1 Object Configuration Module</a></h2>
|
|
<p>This module has the name <strong>oid_section</strong>. The value of this variable points
|
|
to a section containing name value pairs of OIDs: the name is the OID short
|
|
and long name, the value is the numerical form of the OID. Although some of
|
|
the <strong>openssl</strong> utility sub commands already have their own ASN1 OBJECT section
|
|
functionality not all do. By using the ASN1 OBJECT configuration module
|
|
<strong>all</strong> the <strong>openssl</strong> utility sub commands can see the new objects as well
|
|
as any compliant applications. For example:</p>
|
|
<pre>
|
|
[new_oids]</pre>
|
|
<pre>
|
|
some_new_oid = 1.2.3.4
|
|
some_other_oid = 1.2.3.5</pre>
|
|
<p>It is also possible to set the value to the long name followed
|
|
by a comma and the numerical OID form. For example:</p>
|
|
<pre>
|
|
shortName = some object long name, 1.2.3.4</pre>
|
|
<p>
|
|
</p>
|
|
<h2><a name="engine_configuration_module">Engine Configuration Module</a></h2>
|
|
<p>This ENGINE configuration module has the name <strong>engines</strong>. The value of this
|
|
variable points to a section containing further ENGINE configuration
|
|
information.</p>
|
|
<p>The section pointed to by <strong>engines</strong> is a table of engine names (though see
|
|
<strong>engine_id</strong> below) and further sections containing configuration information
|
|
specific to each ENGINE.</p>
|
|
<p>Each ENGINE specific section is used to set default algorithms, load
|
|
dynamic, perform initialization and send ctrls. The actual operation performed
|
|
depends on the <em>command</em> name which is the name of the name value pair. The
|
|
currently supported commands are listed below.</p>
|
|
<p>For example:</p>
|
|
<pre>
|
|
[engine_section]</pre>
|
|
<pre>
|
|
# Configure ENGINE named "foo"
|
|
foo = foo_section
|
|
# Configure ENGINE named "bar"
|
|
bar = bar_section</pre>
|
|
<pre>
|
|
[foo_section]
|
|
... foo ENGINE specific commands ...</pre>
|
|
<pre>
|
|
[bar_section]
|
|
... "bar" ENGINE specific commands ...</pre>
|
|
<p>The command <strong>engine_id</strong> is used to give the ENGINE name. If used this
|
|
command must be first. For example:</p>
|
|
<pre>
|
|
[engine_section]
|
|
# This would normally handle an ENGINE named "foo"
|
|
foo = foo_section</pre>
|
|
<pre>
|
|
[foo_section]
|
|
# Override default name and use "myfoo" instead.
|
|
engine_id = myfoo</pre>
|
|
<p>The command <strong>dynamic_path</strong> loads and adds an ENGINE from the given path. It
|
|
is equivalent to sending the ctrls <strong>SO_PATH</strong> with the path argument followed
|
|
by <strong>LIST_ADD</strong> with value 2 and <strong>LOAD</strong> to the dynamic ENGINE. If this is
|
|
not the required behaviour then alternative ctrls can be sent directly
|
|
to the dynamic ENGINE using ctrl commands.</p>
|
|
<p>The command <strong>init</strong> determines whether to initialize the ENGINE. If the value
|
|
is <strong>0</strong> the ENGINE will not be initialized, if <strong>1</strong> and attempt it made to
|
|
initialized the ENGINE immediately. If the <strong>init</strong> command is not present
|
|
then an attempt will be made to initialize the ENGINE after all commands in
|
|
its section have been processed.</p>
|
|
<p>The command <strong>default_algorithms</strong> sets the default algorithms an ENGINE will
|
|
supply using the functions <code>ENGINE_set_default_string()</code>.</p>
|
|
<p>If the name matches none of the above command names it is assumed to be a
|
|
ctrl command which is sent to the ENGINE. The value of the command is the
|
|
argument to the ctrl command. If the value is the string <strong>EMPTY</strong> then no
|
|
value is sent to the command.</p>
|
|
<p>For example:</p>
|
|
<pre>
|
|
[engine_section]</pre>
|
|
<pre>
|
|
# Configure ENGINE named "foo"
|
|
foo = foo_section</pre>
|
|
<pre>
|
|
[foo_section]
|
|
# Load engine from DSO
|
|
dynamic_path = /some/path/fooengine.so
|
|
# A foo specific ctrl.
|
|
some_ctrl = some_value
|
|
# Another ctrl that doesn't take a value.
|
|
other_ctrl = EMPTY
|
|
# Supply all default algorithms
|
|
default_algorithms = ALL</pre>
|
|
<p>
|
|
</p>
|
|
<h2><a name="provider_configuration_module">Provider Configuration Module</a></h2>
|
|
<p>This provider configuration module has the name <strong>providers</strong>. The
|
|
value of this variable points to a section containing further provider
|
|
configuration information.</p>
|
|
<p>The section pointed to by <strong>providers</strong> is a table of provider names
|
|
(though see <strong>identity</strong> below) and further sections containing
|
|
configuration information specific to each provider module.</p>
|
|
<p>Each provider specific section is used to load its module, perform
|
|
activation and set parameters to pass to the provider on demand. The
|
|
actual operation performed depends on the name of the name value pair.
|
|
The currently supported commands are listed below.</p>
|
|
<p>For example:</p>
|
|
<pre>
|
|
[provider_section]</pre>
|
|
<pre>
|
|
# Configure provider named "foo"
|
|
foo = foo_section
|
|
# Configure provider named "bar"
|
|
bar = bar_section</pre>
|
|
<pre>
|
|
[foo_section]
|
|
... "foo" provider specific parameters ...</pre>
|
|
<pre>
|
|
[bar_section]
|
|
... "bar" provider specific parameters ...</pre>
|
|
<p>The command <strong>identity</strong> is used to give the provider name. For example:</p>
|
|
<pre>
|
|
[provider_section]
|
|
# This would normally handle a provider named "foo"
|
|
foo = foo_section</pre>
|
|
<pre>
|
|
[foo_section]
|
|
# Override default name and use "myfoo" instead.
|
|
identity = myfoo</pre>
|
|
<p>The parameter <strong>module</strong> loads and adds a provider module from the
|
|
given module path. That path may be a simple filename, a relative
|
|
path or an absolute path.</p>
|
|
<p>The parameter <strong>activate</strong> determines whether to activate the
|
|
provider. The value has no importance, the presence of the parameter
|
|
is enough for activation to take place.</p>
|
|
<p>All parameters in the section as well as sub-sections are made
|
|
available to the provider.</p>
|
|
<p>
|
|
</p>
|
|
<h2><a name="evp_configuration_module">EVP Configuration Module</a></h2>
|
|
<p>This module has the name <strong>alg_section</strong> which points to a section containing
|
|
algorithm commands.</p>
|
|
<p>The supported algorithm commands are:</p>
|
|
<dl>
|
|
<dt><strong><a name="default_properties" class="item"><strong>default_properties</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The value may be anything that is acceptable as a property query
|
|
string for <code>EVP_set_default_properties()</code>.</p>
|
|
</dd>
|
|
<dt><strong><a name="fips_mode" class="item"><strong>fips_mode</strong> (deprecated)</a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The value is a boolean that can be <strong>yes</strong> or <strong>no</strong>. If the value is
|
|
<strong>yes</strong>, this is exactly equivalent to:</p>
|
|
<pre>
|
|
default_properties = fips=yes</pre>
|
|
<p>If the value is <strong>no</strong>, nothing happens.</p>
|
|
</dd>
|
|
</dl>
|
|
<p>These two commands should not be used together, as there is no control
|
|
over how they affect each other.
|
|
The use of <strong>fips_mode</strong> is strongly discouraged and is only present
|
|
for backward compatibility with earlier OpenSSL FIPS modules.</p>
|
|
<p>
|
|
</p>
|
|
<h2><a name="ssl_configuration_module">SSL Configuration Module</a></h2>
|
|
<p>This module has the name <strong>ssl_conf</strong> which points to a section containing
|
|
SSL configurations.</p>
|
|
<p>Each line in the SSL configuration section contains the name of the
|
|
configuration and the section containing it.</p>
|
|
<p>Each configuration section consists of command value pairs for <strong>SSL_CONF</strong>.
|
|
Each pair will be passed to a <strong>SSL_CTX</strong> or <strong>SSL</strong> structure if it calls
|
|
<code>SSL_CTX_config()</code> or <code>SSL_config()</code> with the appropriate configuration name.</p>
|
|
<p>Note: any characters before an initial dot in the configuration section are
|
|
ignored so the same command can be used multiple times.</p>
|
|
<p>For example:</p>
|
|
<pre>
|
|
ssl_conf = ssl_sect</pre>
|
|
<pre>
|
|
[ssl_sect]</pre>
|
|
<pre>
|
|
server = server_section</pre>
|
|
<pre>
|
|
[server_section]</pre>
|
|
<pre>
|
|
RSA.Certificate = server-rsa.pem
|
|
ECDSA.Certificate = server-ecdsa.pem
|
|
Ciphers = ALL:!RC4</pre>
|
|
<p>The system default configuration with name <strong>system_default</strong> if present will
|
|
be applied during any creation of the <strong>SSL_CTX</strong> structure.</p>
|
|
<p>Example of a configuration with the system default:</p>
|
|
<pre>
|
|
ssl_conf = ssl_sect</pre>
|
|
<pre>
|
|
[ssl_sect]</pre>
|
|
<pre>
|
|
system_default = system_default_sect</pre>
|
|
<pre>
|
|
[system_default_sect]</pre>
|
|
<pre>
|
|
MinProtocol = TLSv1.2</pre>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="notes">NOTES</a></h1>
|
|
<p>If a configuration file attempts to expand a variable that doesn't exist
|
|
then an error is flagged and the file will not load. This can happen
|
|
if an attempt is made to expand an environment variable that doesn't
|
|
exist. For example in a previous version of OpenSSL the default OpenSSL
|
|
master configuration file used the value of <strong>HOME</strong> which may not be
|
|
defined on non Unix systems and would cause an error.</p>
|
|
<p>This can be worked around by including a <strong>default</strong> section to provide
|
|
a default value: then if the environment lookup fails the default value
|
|
will be used instead. For this to work properly the default value must
|
|
be defined earlier in the configuration file than the expansion. See
|
|
the <strong>EXAMPLES</strong> section for an example of how to do this.</p>
|
|
<p>If the same variable exists in the same section then all but the last
|
|
value will be silently ignored. In certain circumstances such as with
|
|
DNs the same field may occur multiple times. This is usually worked
|
|
around by ignoring any characters before an initial <strong>.</strong> e.g.</p>
|
|
<pre>
|
|
1.OU="My first OU"
|
|
2.OU="My Second OU"</pre>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="examples">EXAMPLES</a></h1>
|
|
<p>Here is a sample configuration file using some of the features
|
|
mentioned above.</p>
|
|
<pre>
|
|
# This is the default section.</pre>
|
|
<pre>
|
|
HOME=/temp
|
|
configdir=$ENV::HOME/config</pre>
|
|
<pre>
|
|
[ section_one ]</pre>
|
|
<pre>
|
|
# We are now in section one.</pre>
|
|
<pre>
|
|
# Quotes permit leading and trailing whitespace
|
|
any = " any variable name "</pre>
|
|
<pre>
|
|
other = A string that can \
|
|
cover several lines \
|
|
by including \\ characters</pre>
|
|
<pre>
|
|
message = Hello World\n</pre>
|
|
<pre>
|
|
[ section_two ]</pre>
|
|
<pre>
|
|
greeting = $section_one::message</pre>
|
|
<p>This next example shows how to expand environment variables safely.</p>
|
|
<p>Suppose you want a variable called <strong>tmpfile</strong> to refer to a
|
|
temporary filename. The directory it is placed in can determined by
|
|
the <strong>TEMP</strong> or <strong>TMP</strong> environment variables but they may not be
|
|
set to any value at all. If you just include the environment variable
|
|
names and the variable doesn't exist then this will cause an error when
|
|
an attempt is made to load the configuration file. By making use of the
|
|
default section both values can be looked up with <strong>TEMP</strong> taking
|
|
priority and <strong>/tmp</strong> used if neither is defined:</p>
|
|
<pre>
|
|
TMP=/tmp
|
|
# The above value is used if TMP isn't in the environment
|
|
TEMP=$ENV::TMP
|
|
# The above value is used if TEMP isn't in the environment
|
|
tmpfile=${ENV::TEMP}/tmp.filename</pre>
|
|
<p>Simple OpenSSL library configuration example to enter FIPS mode:</p>
|
|
<pre>
|
|
# Default appname: should match "appname" parameter (if any)
|
|
# supplied to CONF_modules_load_file et al.
|
|
openssl_conf = openssl_conf_section</pre>
|
|
<pre>
|
|
[openssl_conf_section]
|
|
# Configuration module list
|
|
alg_section = evp_sect</pre>
|
|
<pre>
|
|
[evp_sect]
|
|
# Set to "yes" to enter FIPS mode if supported
|
|
fips_mode = yes</pre>
|
|
<p>Note: in the above example you will get an error in non FIPS capable versions
|
|
of OpenSSL.</p>
|
|
<p>Simple OpenSSL library configuration to make TLS 1.3 the system-default
|
|
minimum TLS version:</p>
|
|
<pre>
|
|
# Toplevel section for openssl (including libssl)
|
|
openssl_conf = default_conf_section</pre>
|
|
<pre>
|
|
[default_conf_section]
|
|
# We only specify configuration for the "ssl module"
|
|
ssl_conf = ssl_section</pre>
|
|
<pre>
|
|
[ssl_section]
|
|
system_default = system_default_section</pre>
|
|
<pre>
|
|
[system_default_section]
|
|
MinProtocol = TLSv1.3</pre>
|
|
<p>More complex OpenSSL library configuration. Add OID and don't enter FIPS mode:</p>
|
|
<pre>
|
|
# Default appname: should match "appname" parameter (if any)
|
|
# supplied to CONF_modules_load_file et al.
|
|
openssl_conf = openssl_conf_section</pre>
|
|
<pre>
|
|
[openssl_conf_section]
|
|
# Configuration module list
|
|
alg_section = evp_sect
|
|
oid_section = new_oids</pre>
|
|
<pre>
|
|
[evp_sect]
|
|
# This will have no effect as FIPS mode is off by default.
|
|
# Set to "yes" to enter FIPS mode, if supported
|
|
fips_mode = no</pre>
|
|
<pre>
|
|
[new_oids]
|
|
# New OID, just short name
|
|
newoid1 = 1.2.3.4.1
|
|
# New OID shortname and long name
|
|
newoid2 = New OID 2 long name, 1.2.3.4.2</pre>
|
|
<p>The above examples can be used with any application supporting library
|
|
configuration if "openssl_conf" is modified to match the appropriate "appname".</p>
|
|
<p>For example if the second sample file above is saved to "example.cnf" then
|
|
the command line:</p>
|
|
<pre>
|
|
OPENSSL_CONF=example.cnf openssl asn1parse -genstr OID:1.2.3.4.1</pre>
|
|
<p>will output:</p>
|
|
<pre>
|
|
0:d=0 hl=2 l= 4 prim: OBJECT :newoid1</pre>
|
|
<p>showing that the OID "newoid1" has been added as "1.2.3.4.1".</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="environment">ENVIRONMENT</a></h1>
|
|
<dl>
|
|
<dt><strong><a name="openssl_conf" class="item"><strong>OPENSSL_CONF</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The path to the config file.
|
|
Ignored in set-user-ID and set-group-ID programs.</p>
|
|
</dd>
|
|
<dt><strong><a name="openssl_engines" class="item"><strong>OPENSSL_ENGINES</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The path to the engines directory.
|
|
Ignored in set-user-ID and set-group-ID programs.</p>
|
|
</dd>
|
|
<dt><strong><a name="openssl_modules" class="item"><strong>OPENSSL_MODULES</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The path to the directory with OpenSSL modules, such as providers.
|
|
Ignored in set-user-ID and set-group-ID programs.</p>
|
|
</dd>
|
|
<dt><strong><a name="openssl_conf_include" class="item"><strong>OPENSSL_CONF_INCLUDE</strong></a></strong></dt>
|
|
|
|
<dd>
|
|
<p>The optional path to prepend to all .include paths.</p>
|
|
</dd>
|
|
</dl>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="bugs">BUGS</a></h1>
|
|
<p>Currently there is no way to include characters using the octal <strong>\nnn</strong>
|
|
form. Strings are all null terminated so nulls cannot form part of
|
|
the value.</p>
|
|
<p>The escaping isn't quite right: if you want to use sequences like <strong>\n</strong>
|
|
you can't use any quote escaping on the same line.</p>
|
|
<p>Files are loaded in a single pass. This means that an variable expansion
|
|
will only work if the variables referenced are defined earlier in the
|
|
file.</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="history">HISTORY</a></h1>
|
|
<p>An undocumented API, NCONF_WIN32(), used a slightly different set
|
|
of parsing rules there were intended to be tailored to
|
|
the Microsoft Windows platform.
|
|
Specifically, the backslash character was not an escape character and
|
|
could be used in pathnames, only the double-quote character was recognized,
|
|
and comments began with a semi-colon.
|
|
This function was deprecated in OpenSSL 3.0; applications with
|
|
configuration files using that syntax will have to be modified.</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="see_also">SEE ALSO</a></h1>
|
|
<p><em>openssl-x509(1)</em>, <em>openssl-req(1)</em>, <em>openssl-ca(1)</em>, <em>fips_config(5)</em></p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="copyright">COPYRIGHT</a></h1>
|
|
<p>Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
|
|
<p>Licensed under the Apache License 2.0 (the "License"). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file LICENSE in the source distribution or at
|
|
<a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
|
|
|
</body>
|
|
|
|
</html>
|