From 2a1c246425f8a0d5a7e2b3a9aed2d6f4b3f8cbfb Mon Sep 17 00:00:00 2001 From: Frank Brehm Date: Tue, 14 Jan 2025 10:58:03 +0100 Subject: [PATCH] Adding ssl/tls/ --- .etckeeper | 17 + ssl/tls/certs/ca-bundle.crt | 1 + ssl/tls/certs/ca-bundle.trust.crt | 1 + ssl/tls/certs/wildcard.pixelpark.com-cert.pem | 35 ++ .../certs/wildcard.pixelpark.com-chain.pem | 27 ++ .../wildcard.pixelpark.com-fullchain.pem | 62 +++ ssl/tls/certs/wildcard.pixelpark.net-cert.pem | 35 ++ .../certs/wildcard.pixelpark.net-chain.pem | 27 ++ .../wildcard.pixelpark.net-fullchain.pem | 62 +++ ssl/tls/ct_log_list.cnf | 9 + ssl/tls/openssl.cnf | 402 ++++++++++++++++++ .../private/wildcard.pixelpark.com-key.pem | 28 ++ .../private/wildcard.pixelpark.net-key.pem | 28 ++ 13 files changed, 734 insertions(+) create mode 120000 ssl/tls/certs/ca-bundle.crt create mode 120000 ssl/tls/certs/ca-bundle.trust.crt create mode 100644 ssl/tls/certs/wildcard.pixelpark.com-cert.pem create mode 100644 ssl/tls/certs/wildcard.pixelpark.com-chain.pem create mode 100644 ssl/tls/certs/wildcard.pixelpark.com-fullchain.pem create mode 100644 ssl/tls/certs/wildcard.pixelpark.net-cert.pem create mode 100644 ssl/tls/certs/wildcard.pixelpark.net-chain.pem create mode 100644 ssl/tls/certs/wildcard.pixelpark.net-fullchain.pem create mode 100644 ssl/tls/ct_log_list.cnf create mode 100644 ssl/tls/openssl.cnf create mode 100644 ssl/tls/private/wildcard.pixelpark.com-key.pem create mode 100644 ssl/tls/private/wildcard.pixelpark.net-key.pem diff --git a/.etckeeper b/.etckeeper index ab173b8..525857c 100755 --- a/.etckeeper +++ b/.etckeeper @@ -35,6 +35,8 @@ mkdir -p './security/limits.d' mkdir -p './security/namespace.d' mkdir -p './ssh/ssh_config.d' mkdir -p './ssh/sshd_config.d' +mkdir -p './ssl/tls/misc' +mkdir -p './ssl/tls/openssl.d' mkdir -p './systemd/network' mkdir -p './udev/hwdb.d' mkdir -p './udev/rules.d' @@ -1192,6 +1194,21 @@ maybe chgrp 'ssl-cert' 'ssl/private' maybe chmod 0710 'ssl/private' maybe chgrp 'ssl-cert' 'ssl/private/ssl-cert-snakeoil.key' maybe chmod 0640 'ssl/private/ssl-cert-snakeoil.key' +maybe chmod 0755 'ssl/tls' +maybe chmod 0755 'ssl/tls/certs' +maybe chmod 0640 'ssl/tls/certs/wildcard.pixelpark.com-cert.pem' +maybe chmod 0640 'ssl/tls/certs/wildcard.pixelpark.com-chain.pem' +maybe chmod 0640 'ssl/tls/certs/wildcard.pixelpark.com-fullchain.pem' +maybe chmod 0640 'ssl/tls/certs/wildcard.pixelpark.net-cert.pem' +maybe chmod 0640 'ssl/tls/certs/wildcard.pixelpark.net-chain.pem' +maybe chmod 0640 'ssl/tls/certs/wildcard.pixelpark.net-fullchain.pem' +maybe chmod 0644 'ssl/tls/ct_log_list.cnf' +maybe chmod 0755 'ssl/tls/misc' +maybe chmod 0644 'ssl/tls/openssl.cnf' +maybe chmod 0755 'ssl/tls/openssl.d' +maybe chmod 0700 'ssl/tls/private' +maybe chmod 0400 'ssl/tls/private/wildcard.pixelpark.com-key.pem' +maybe chmod 0400 'ssl/tls/private/wildcard.pixelpark.net-key.pem' maybe chmod 0644 'subgid' maybe chmod 0644 'subgid-' maybe chmod 0644 'subuid' diff --git a/ssl/tls/certs/ca-bundle.crt b/ssl/tls/certs/ca-bundle.crt new file mode 120000 index 0000000..6f3a038 --- /dev/null +++ b/ssl/tls/certs/ca-bundle.crt @@ -0,0 +1 @@ +/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \ No newline at end of file diff --git a/ssl/tls/certs/ca-bundle.trust.crt b/ssl/tls/certs/ca-bundle.trust.crt new file mode 120000 index 0000000..1aa9c8d --- /dev/null +++ b/ssl/tls/certs/ca-bundle.trust.crt @@ -0,0 +1 @@ +/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt \ No newline at end of file diff --git a/ssl/tls/certs/wildcard.pixelpark.com-cert.pem b/ssl/tls/certs/wildcard.pixelpark.com-cert.pem new file mode 100644 index 0000000..be850bb --- /dev/null +++ b/ssl/tls/certs/wildcard.pixelpark.com-cert.pem @@ -0,0 +1,35 @@ +-----BEGIN CERTIFICATE----- +MIIGHTCCBQWgAwIBAgIQD9of0piu4kECBYp7KBaGSTANBgkqhkiG9w0BAQsFADBg +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMR8wHQYDVQQDExZHZW9UcnVzdCBUTFMgUlNBIENBIEcx +MB4XDTI0MDQwODAwMDAwMFoXDTI1MDQyODIzNTk1OVowGjEYMBYGA1UEAwwPKi5w +aXhlbHBhcmsuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApb+P +FRmrEm7E2AsRqm0I/e91Ms/NVo0IXxAAG7YmTe8DCbI5PvkVecbICBUizDg3oOqS +wMgO1mz8198KRPpikHCtf6Qn5vXTJ026rAAQgXW5TR8AfJzZ6qs/GvRCTbRZgW1s +WBmo6ZbzT3NjBr+6voT54ulVJgw5yP4G2cwkCdrDeLtoSv6hfOu5kzOnwtNwN5rB +Qy7sT5z1J0k1Pp7w1pMBrhwDwS/TszFloeSByzxMPb8N+NrTH/gGYLRzHCfjSdlG +DmACi/Uj3gUMDV8W52YyO9jmurPXDKQCuIPdowhNGURwWxwXFOx9u90BgT+yo+Vj +wkhvNixTMR8jF8ZbRwIDAQABo4IDFzCCAxMwHwYDVR0jBBgwFoAUlE/UXYvkpOKm +gP792PkA76O+AlcwHQYDVR0OBBYEFKJi0AfKvYBWyCvtVGUIF71zO/zpMBoGA1Ud +EQQTMBGCDyoucGl4ZWxwYXJrLmNvbTA+BgNVHSAENzA1MDMGBmeBDAECATApMCcG +CCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDgYDVR0PAQH/ +BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA/BgNVHR8EODA2 +MDSgMqAwhi5odHRwOi8vY2RwLmdlb3RydXN0LmNvbS9HZW9UcnVzdFRMU1JTQUNB +RzEuY3JsMHYGCCsGAQUFBwEBBGowaDAmBggrBgEFBQcwAYYaaHR0cDovL3N0YXR1 +cy5nZW90cnVzdC5jb20wPgYIKwYBBQUHMAKGMmh0dHA6Ly9jYWNlcnRzLmdlb3Ry +dXN0LmNvbS9HZW9UcnVzdFRMU1JTQUNBRzEuY3J0MAwGA1UdEwEB/wQCMAAwggF9 +BgorBgEEAdZ5AgQCBIIBbQSCAWkBZwB2AM8RVu7VLnyv84db2Wkum+kacWdKsBfs +rAHSW3fOzDsIAAABjr3PjtIAAAQDAEcwRQIgR93PsljrfZcOaajBaKPKPTXb98th +DPYgy55XyuntCN8CIQCF4C2aZLzQktl7H4oPRifpTD0W0jpHS4lEN1JEnzwUhgB2 +AH1ZHhLheCp7HGFnfF79+NCHXBSgTpWeuQMv2Q6MLnm4AAABjr3PjtEAAAQDAEcw +RQIhAPVxPibKLmKzAynDag5Q7jSp1abSZm6fZ72h55Z98xW+AiABECkOf+t+jTCJ +XTptoCSSdugn1Uiw6MeZs7KVTunsVQB1AObSMWNAd4zBEEEG13G5zsHSQPaWhIb7 +uocyHf0eN45QAAABjr3PjuMAAAQDAEYwRAIgOOWmbBtyzvcYmDVlW/Iozd+UZNDf +TUmuxupje6LLMUQCIGwmJay+zSo2QOQjrtdpCM07Fchdpo8QAzPnYBbzjsyVMA0G +CSqGSIb3DQEBCwUAA4IBAQC0GOOFNOSgn8dHN6cwDQ1KHIcAl19SpxGDhe+32WEv +YtNxSrPH2dK/A7iJP3L8nstSdwgjwa3l5XLZM+4fg5Ff0BNTNO8QALZe4CC+awqy +nw1EG/gzHORMDbqHH9FxhEPsJ+xCOUy3zQQqd5tJFs6c3riPYLrK/r91AXn0CNQC +7FNeujN0h0rsvKneKGLL/YKUmsf/E1353IDEnHzG3RuJRQHxRCYp7QSCgbp/YQVo +plgKYoGabLWYm6Mu+QAyjzvAPZLIWo0Z4eEV4RYX8zgvNStXnsrW6UCsBBtvoXQm +vOnWM/CvPUJSTqnC/Xr8TmpDqbxrIiH2fJeO6lRM0s2h +-----END CERTIFICATE----- diff --git a/ssl/tls/certs/wildcard.pixelpark.com-chain.pem b/ssl/tls/certs/wildcard.pixelpark.com-chain.pem new file mode 100644 index 0000000..9642eed --- /dev/null +++ b/ssl/tls/certs/wildcard.pixelpark.com-chain.pem @@ -0,0 +1,27 @@ +-----BEGIN CERTIFICATE----- +MIIEjTCCA3WgAwIBAgIQDQd4KhM/xvmlcpbhMf/ReTANBgkqhkiG9w0BAQsFADBh +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH +MjAeFw0xNzExMDIxMjIzMzdaFw0yNzExMDIxMjIzMzdaMGAxCzAJBgNVBAYTAlVT +MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j +b20xHzAdBgNVBAMTFkdlb1RydXN0IFRMUyBSU0EgQ0EgRzEwggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQC+F+jsvikKy/65LWEx/TMkCDIuWegh1Ngwvm4Q +yISgP7oU5d79eoySG3vOhC3w/3jEMuipoH1fBtp7m0tTpsYbAhch4XA7rfuD6whU +gajeErLVxoiWMPkC/DnUvbgi74BJmdBiuGHQSd7LwsuXpTEGG9fYXcbTVN5SATYq +DfbexbYxTMwVJWoVb6lrBEgM3gBBqiiAiy800xu1Nq07JdCIQkBsNpFtZbIZhsDS +fzlGWP4wEmBQ3O67c+ZXkFr2DcrXBEtHam80Gp2SNhou2U5U7UesDL/xgLK6/0d7 +6TnEVMSUVJkZ8VeZr+IUIlvoLrtjLbqugb0T3OYXW+CQU0kBAgMBAAGjggFAMIIB +PDAdBgNVHQ4EFgQUlE/UXYvkpOKmgP792PkA76O+AlcwHwYDVR0jBBgwFoAUTiJU +IBiV5uNu5g/6+rkS7QYXjzkwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsG +AQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMDQGCCsGAQUFBwEB +BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEIGA1Ud +HwQ7MDkwN6A1oDOGMWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEds +b2JhbFJvb3RHMi5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEW +HGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEB +AIIcBDqC6cWpyGUSXAjjAcYwsK4iiGF7KweG97i1RJz1kwZhRoo6orU1JtBYnjzB +c4+/sXmnHJk3mlPyL1xuIAt9sMeC7+vreRIF5wFBC0MCN5sbHwhNN1JzKbifNeP5 +ozpZdQFmkCo+neBiKR6HqIA+LMTMCMMuv2khGGuPHmtDze4GmEGZtYLyF8EQpa5Y +jPuV6k2Cr/N3XxFpT3hRpt/3usU/Zb9wfKPtWpoznZ4/44c1p9rzFcZYrWkj3A+7 +TNBJE0GmP2fhXhP1D/XVfIW/h0yCJGEiV9Glm/uGOa3DXHlmbAcxSyCRraG+ZBkA +7h4SeM6Y8l/7MBRpPCz6l8Y= +-----END CERTIFICATE----- diff --git a/ssl/tls/certs/wildcard.pixelpark.com-fullchain.pem b/ssl/tls/certs/wildcard.pixelpark.com-fullchain.pem new file mode 100644 index 0000000..b2dd8a6 --- /dev/null +++ b/ssl/tls/certs/wildcard.pixelpark.com-fullchain.pem @@ -0,0 +1,62 @@ +-----BEGIN CERTIFICATE----- +MIIGHTCCBQWgAwIBAgIQD9of0piu4kECBYp7KBaGSTANBgkqhkiG9w0BAQsFADBg +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMR8wHQYDVQQDExZHZW9UcnVzdCBUTFMgUlNBIENBIEcx +MB4XDTI0MDQwODAwMDAwMFoXDTI1MDQyODIzNTk1OVowGjEYMBYGA1UEAwwPKi5w +aXhlbHBhcmsuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApb+P +FRmrEm7E2AsRqm0I/e91Ms/NVo0IXxAAG7YmTe8DCbI5PvkVecbICBUizDg3oOqS +wMgO1mz8198KRPpikHCtf6Qn5vXTJ026rAAQgXW5TR8AfJzZ6qs/GvRCTbRZgW1s +WBmo6ZbzT3NjBr+6voT54ulVJgw5yP4G2cwkCdrDeLtoSv6hfOu5kzOnwtNwN5rB +Qy7sT5z1J0k1Pp7w1pMBrhwDwS/TszFloeSByzxMPb8N+NrTH/gGYLRzHCfjSdlG +DmACi/Uj3gUMDV8W52YyO9jmurPXDKQCuIPdowhNGURwWxwXFOx9u90BgT+yo+Vj +wkhvNixTMR8jF8ZbRwIDAQABo4IDFzCCAxMwHwYDVR0jBBgwFoAUlE/UXYvkpOKm +gP792PkA76O+AlcwHQYDVR0OBBYEFKJi0AfKvYBWyCvtVGUIF71zO/zpMBoGA1Ud +EQQTMBGCDyoucGl4ZWxwYXJrLmNvbTA+BgNVHSAENzA1MDMGBmeBDAECATApMCcG +CCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDgYDVR0PAQH/ +BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA/BgNVHR8EODA2 +MDSgMqAwhi5odHRwOi8vY2RwLmdlb3RydXN0LmNvbS9HZW9UcnVzdFRMU1JTQUNB +RzEuY3JsMHYGCCsGAQUFBwEBBGowaDAmBggrBgEFBQcwAYYaaHR0cDovL3N0YXR1 +cy5nZW90cnVzdC5jb20wPgYIKwYBBQUHMAKGMmh0dHA6Ly9jYWNlcnRzLmdlb3Ry +dXN0LmNvbS9HZW9UcnVzdFRMU1JTQUNBRzEuY3J0MAwGA1UdEwEB/wQCMAAwggF9 +BgorBgEEAdZ5AgQCBIIBbQSCAWkBZwB2AM8RVu7VLnyv84db2Wkum+kacWdKsBfs +rAHSW3fOzDsIAAABjr3PjtIAAAQDAEcwRQIgR93PsljrfZcOaajBaKPKPTXb98th +DPYgy55XyuntCN8CIQCF4C2aZLzQktl7H4oPRifpTD0W0jpHS4lEN1JEnzwUhgB2 +AH1ZHhLheCp7HGFnfF79+NCHXBSgTpWeuQMv2Q6MLnm4AAABjr3PjtEAAAQDAEcw +RQIhAPVxPibKLmKzAynDag5Q7jSp1abSZm6fZ72h55Z98xW+AiABECkOf+t+jTCJ +XTptoCSSdugn1Uiw6MeZs7KVTunsVQB1AObSMWNAd4zBEEEG13G5zsHSQPaWhIb7 +uocyHf0eN45QAAABjr3PjuMAAAQDAEYwRAIgOOWmbBtyzvcYmDVlW/Iozd+UZNDf +TUmuxupje6LLMUQCIGwmJay+zSo2QOQjrtdpCM07Fchdpo8QAzPnYBbzjsyVMA0G +CSqGSIb3DQEBCwUAA4IBAQC0GOOFNOSgn8dHN6cwDQ1KHIcAl19SpxGDhe+32WEv +YtNxSrPH2dK/A7iJP3L8nstSdwgjwa3l5XLZM+4fg5Ff0BNTNO8QALZe4CC+awqy +nw1EG/gzHORMDbqHH9FxhEPsJ+xCOUy3zQQqd5tJFs6c3riPYLrK/r91AXn0CNQC +7FNeujN0h0rsvKneKGLL/YKUmsf/E1353IDEnHzG3RuJRQHxRCYp7QSCgbp/YQVo +plgKYoGabLWYm6Mu+QAyjzvAPZLIWo0Z4eEV4RYX8zgvNStXnsrW6UCsBBtvoXQm +vOnWM/CvPUJSTqnC/Xr8TmpDqbxrIiH2fJeO6lRM0s2h +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEjTCCA3WgAwIBAgIQDQd4KhM/xvmlcpbhMf/ReTANBgkqhkiG9w0BAQsFADBh +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH +MjAeFw0xNzExMDIxMjIzMzdaFw0yNzExMDIxMjIzMzdaMGAxCzAJBgNVBAYTAlVT +MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j +b20xHzAdBgNVBAMTFkdlb1RydXN0IFRMUyBSU0EgQ0EgRzEwggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQC+F+jsvikKy/65LWEx/TMkCDIuWegh1Ngwvm4Q +yISgP7oU5d79eoySG3vOhC3w/3jEMuipoH1fBtp7m0tTpsYbAhch4XA7rfuD6whU +gajeErLVxoiWMPkC/DnUvbgi74BJmdBiuGHQSd7LwsuXpTEGG9fYXcbTVN5SATYq +DfbexbYxTMwVJWoVb6lrBEgM3gBBqiiAiy800xu1Nq07JdCIQkBsNpFtZbIZhsDS +fzlGWP4wEmBQ3O67c+ZXkFr2DcrXBEtHam80Gp2SNhou2U5U7UesDL/xgLK6/0d7 +6TnEVMSUVJkZ8VeZr+IUIlvoLrtjLbqugb0T3OYXW+CQU0kBAgMBAAGjggFAMIIB +PDAdBgNVHQ4EFgQUlE/UXYvkpOKmgP792PkA76O+AlcwHwYDVR0jBBgwFoAUTiJU +IBiV5uNu5g/6+rkS7QYXjzkwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsG +AQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMDQGCCsGAQUFBwEB +BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEIGA1Ud +HwQ7MDkwN6A1oDOGMWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEds +b2JhbFJvb3RHMi5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEW +HGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEB +AIIcBDqC6cWpyGUSXAjjAcYwsK4iiGF7KweG97i1RJz1kwZhRoo6orU1JtBYnjzB +c4+/sXmnHJk3mlPyL1xuIAt9sMeC7+vreRIF5wFBC0MCN5sbHwhNN1JzKbifNeP5 +ozpZdQFmkCo+neBiKR6HqIA+LMTMCMMuv2khGGuPHmtDze4GmEGZtYLyF8EQpa5Y +jPuV6k2Cr/N3XxFpT3hRpt/3usU/Zb9wfKPtWpoznZ4/44c1p9rzFcZYrWkj3A+7 +TNBJE0GmP2fhXhP1D/XVfIW/h0yCJGEiV9Glm/uGOa3DXHlmbAcxSyCRraG+ZBkA +7h4SeM6Y8l/7MBRpPCz6l8Y= +-----END CERTIFICATE----- diff --git a/ssl/tls/certs/wildcard.pixelpark.net-cert.pem b/ssl/tls/certs/wildcard.pixelpark.net-cert.pem new file mode 100644 index 0000000..dcd406d --- /dev/null +++ b/ssl/tls/certs/wildcard.pixelpark.net-cert.pem @@ -0,0 +1,35 @@ +-----BEGIN CERTIFICATE----- +MIIGHTCCBQWgAwIBAgIQASQ+L6xKeKan4vtFOnpM0jANBgkqhkiG9w0BAQsFADBg +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMR8wHQYDVQQDExZHZW9UcnVzdCBUTFMgUlNBIENBIEcx +MB4XDTI0MDQwODAwMDAwMFoXDTI1MDQyODIzNTk1OVowGjEYMBYGA1UEAwwPKi5w +aXhlbHBhcmsubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAjl1/ +pwa5OhiuEtLzN4CoTInNIvmscfHjrV4pcdvgX7zQoInMlBQwm7i57XP78WZFVDlR +6aXcdTymiCTFmCMLnW5G7rT3XAtHQcmiMNOZcMSiRDcGkCD3DCOMxgF/2LPCfp0p +yG1kgbXPzoo8lzGEQvhOcS+WaH6jN4bClXDaN6WCCgZDSve1t1oRMiUMHsW10SNc +/+EnSDFS6INfotHBzz1zqqwm5AuqZrghWzbptE8Y2S5IdCv3ffx0lo1G7J/5gMRc +GdMTOjXDnn6fa3IXL65IIVXQUxWPbm6wbUN2/sXJJXN3TizmSrgbx0P/SDvuQA0J +sxy3Ra5L4sPDQPoG8wIDAQABo4IDFzCCAxMwHwYDVR0jBBgwFoAUlE/UXYvkpOKm +gP792PkA76O+AlcwHQYDVR0OBBYEFCc+MQPHoA1aWNm88HhNi2rIUgBGMBoGA1Ud +EQQTMBGCDyoucGl4ZWxwYXJrLm5ldDA+BgNVHSAENzA1MDMGBmeBDAECATApMCcG +CCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDgYDVR0PAQH/ +BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA/BgNVHR8EODA2 +MDSgMqAwhi5odHRwOi8vY2RwLmdlb3RydXN0LmNvbS9HZW9UcnVzdFRMU1JTQUNB +RzEuY3JsMHYGCCsGAQUFBwEBBGowaDAmBggrBgEFBQcwAYYaaHR0cDovL3N0YXR1 +cy5nZW90cnVzdC5jb20wPgYIKwYBBQUHMAKGMmh0dHA6Ly9jYWNlcnRzLmdlb3Ry +dXN0LmNvbS9HZW9UcnVzdFRMU1JTQUNBRzEuY3J0MAwGA1UdEwEB/wQCMAAwggF9 +BgorBgEEAdZ5AgQCBIIBbQSCAWkBZwB1AE51oydcmhDDOFts1N8/Uusd8OCOG41p +wLH6ZLFimjnfAAABjr3QE9oAAAQDAEYwRAIge0F3h1ldHCBqePwQEkXa4cdVgEyx +dIYHETGwZ64TRsUCIByaUUnmy3nGkXJoLArKVeTlUUqAz78sdYdSqiFD/HUEAHUA +fVkeEuF4KnscYWd8Xv340IdcFKBOlZ65Ay/ZDowuebgAAAGOvdAUFQAABAMARjBE +AiBncWwDQ5bLRVDP3ItuQ2L/liIi+gHGLuRFyLX5C4Y1mAIgL82eMY6HXnTmy6qC +fa0oyUJn8z6lFjlN395o+V5yK2gAdwDm0jFjQHeMwRBBBtdxuc7B0kD2loSG+7qH +Mh39HjeOUAAAAY690BQpAAAEAwBIMEYCIQC9SzCbZTVFfHA3xVoxN2P+aehSBdy7 +wF1gTXixGZ27tQIhAKy7+p+jtsvzX2aa5uzKxeUSVXwPeFP5AGCfFv1HhPC4MA0G +CSqGSIb3DQEBCwUAA4IBAQA/iaq6AE7ymDtLo/XKVru/lZd2mA7YSKGL7seiPnRU +ua1r8Xhsg3QN17EabqvbTv7gBUgqHhOXF16wqi+CnwJgCU+B+iVNAHuhb76/GZOD +dVlPTD8fD0vnZZ6YbqZqzLzzTom/vghFQtszUG/e1k4P3kYDmN1bMHv6WHbT8Jg/ +2Yr6tyLbtY0iphE+JvA2Fv+n+Ju0cp+WmOhTC40tAeP/dWWjSO5/NychjkVlrYD1 +qlcn7iIC5eTCblIuB2nHwcAs9F5Yi3B9BHXrTK/GGt5IUjCcY2zIOsI9Opuw1naY +Li8u68DsPF+bxudLdmf3Q0il0l/jsDsKEKalQohwI1Qc +-----END CERTIFICATE----- diff --git a/ssl/tls/certs/wildcard.pixelpark.net-chain.pem b/ssl/tls/certs/wildcard.pixelpark.net-chain.pem new file mode 100644 index 0000000..9642eed --- /dev/null +++ b/ssl/tls/certs/wildcard.pixelpark.net-chain.pem @@ -0,0 +1,27 @@ +-----BEGIN CERTIFICATE----- +MIIEjTCCA3WgAwIBAgIQDQd4KhM/xvmlcpbhMf/ReTANBgkqhkiG9w0BAQsFADBh +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH +MjAeFw0xNzExMDIxMjIzMzdaFw0yNzExMDIxMjIzMzdaMGAxCzAJBgNVBAYTAlVT +MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j +b20xHzAdBgNVBAMTFkdlb1RydXN0IFRMUyBSU0EgQ0EgRzEwggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQC+F+jsvikKy/65LWEx/TMkCDIuWegh1Ngwvm4Q +yISgP7oU5d79eoySG3vOhC3w/3jEMuipoH1fBtp7m0tTpsYbAhch4XA7rfuD6whU +gajeErLVxoiWMPkC/DnUvbgi74BJmdBiuGHQSd7LwsuXpTEGG9fYXcbTVN5SATYq +DfbexbYxTMwVJWoVb6lrBEgM3gBBqiiAiy800xu1Nq07JdCIQkBsNpFtZbIZhsDS +fzlGWP4wEmBQ3O67c+ZXkFr2DcrXBEtHam80Gp2SNhou2U5U7UesDL/xgLK6/0d7 +6TnEVMSUVJkZ8VeZr+IUIlvoLrtjLbqugb0T3OYXW+CQU0kBAgMBAAGjggFAMIIB +PDAdBgNVHQ4EFgQUlE/UXYvkpOKmgP792PkA76O+AlcwHwYDVR0jBBgwFoAUTiJU +IBiV5uNu5g/6+rkS7QYXjzkwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsG +AQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMDQGCCsGAQUFBwEB +BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEIGA1Ud +HwQ7MDkwN6A1oDOGMWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEds +b2JhbFJvb3RHMi5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEW +HGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEB +AIIcBDqC6cWpyGUSXAjjAcYwsK4iiGF7KweG97i1RJz1kwZhRoo6orU1JtBYnjzB +c4+/sXmnHJk3mlPyL1xuIAt9sMeC7+vreRIF5wFBC0MCN5sbHwhNN1JzKbifNeP5 +ozpZdQFmkCo+neBiKR6HqIA+LMTMCMMuv2khGGuPHmtDze4GmEGZtYLyF8EQpa5Y +jPuV6k2Cr/N3XxFpT3hRpt/3usU/Zb9wfKPtWpoznZ4/44c1p9rzFcZYrWkj3A+7 +TNBJE0GmP2fhXhP1D/XVfIW/h0yCJGEiV9Glm/uGOa3DXHlmbAcxSyCRraG+ZBkA +7h4SeM6Y8l/7MBRpPCz6l8Y= +-----END CERTIFICATE----- diff --git a/ssl/tls/certs/wildcard.pixelpark.net-fullchain.pem b/ssl/tls/certs/wildcard.pixelpark.net-fullchain.pem new file mode 100644 index 0000000..f0d21ab --- /dev/null +++ b/ssl/tls/certs/wildcard.pixelpark.net-fullchain.pem @@ -0,0 +1,62 @@ +-----BEGIN CERTIFICATE----- +MIIGHTCCBQWgAwIBAgIQASQ+L6xKeKan4vtFOnpM0jANBgkqhkiG9w0BAQsFADBg +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMR8wHQYDVQQDExZHZW9UcnVzdCBUTFMgUlNBIENBIEcx +MB4XDTI0MDQwODAwMDAwMFoXDTI1MDQyODIzNTk1OVowGjEYMBYGA1UEAwwPKi5w +aXhlbHBhcmsubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAjl1/ +pwa5OhiuEtLzN4CoTInNIvmscfHjrV4pcdvgX7zQoInMlBQwm7i57XP78WZFVDlR +6aXcdTymiCTFmCMLnW5G7rT3XAtHQcmiMNOZcMSiRDcGkCD3DCOMxgF/2LPCfp0p +yG1kgbXPzoo8lzGEQvhOcS+WaH6jN4bClXDaN6WCCgZDSve1t1oRMiUMHsW10SNc +/+EnSDFS6INfotHBzz1zqqwm5AuqZrghWzbptE8Y2S5IdCv3ffx0lo1G7J/5gMRc +GdMTOjXDnn6fa3IXL65IIVXQUxWPbm6wbUN2/sXJJXN3TizmSrgbx0P/SDvuQA0J +sxy3Ra5L4sPDQPoG8wIDAQABo4IDFzCCAxMwHwYDVR0jBBgwFoAUlE/UXYvkpOKm +gP792PkA76O+AlcwHQYDVR0OBBYEFCc+MQPHoA1aWNm88HhNi2rIUgBGMBoGA1Ud +EQQTMBGCDyoucGl4ZWxwYXJrLm5ldDA+BgNVHSAENzA1MDMGBmeBDAECATApMCcG +CCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDgYDVR0PAQH/ +BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA/BgNVHR8EODA2 +MDSgMqAwhi5odHRwOi8vY2RwLmdlb3RydXN0LmNvbS9HZW9UcnVzdFRMU1JTQUNB +RzEuY3JsMHYGCCsGAQUFBwEBBGowaDAmBggrBgEFBQcwAYYaaHR0cDovL3N0YXR1 +cy5nZW90cnVzdC5jb20wPgYIKwYBBQUHMAKGMmh0dHA6Ly9jYWNlcnRzLmdlb3Ry +dXN0LmNvbS9HZW9UcnVzdFRMU1JTQUNBRzEuY3J0MAwGA1UdEwEB/wQCMAAwggF9 +BgorBgEEAdZ5AgQCBIIBbQSCAWkBZwB1AE51oydcmhDDOFts1N8/Uusd8OCOG41p +wLH6ZLFimjnfAAABjr3QE9oAAAQDAEYwRAIge0F3h1ldHCBqePwQEkXa4cdVgEyx +dIYHETGwZ64TRsUCIByaUUnmy3nGkXJoLArKVeTlUUqAz78sdYdSqiFD/HUEAHUA +fVkeEuF4KnscYWd8Xv340IdcFKBOlZ65Ay/ZDowuebgAAAGOvdAUFQAABAMARjBE +AiBncWwDQ5bLRVDP3ItuQ2L/liIi+gHGLuRFyLX5C4Y1mAIgL82eMY6HXnTmy6qC +fa0oyUJn8z6lFjlN395o+V5yK2gAdwDm0jFjQHeMwRBBBtdxuc7B0kD2loSG+7qH +Mh39HjeOUAAAAY690BQpAAAEAwBIMEYCIQC9SzCbZTVFfHA3xVoxN2P+aehSBdy7 +wF1gTXixGZ27tQIhAKy7+p+jtsvzX2aa5uzKxeUSVXwPeFP5AGCfFv1HhPC4MA0G +CSqGSIb3DQEBCwUAA4IBAQA/iaq6AE7ymDtLo/XKVru/lZd2mA7YSKGL7seiPnRU +ua1r8Xhsg3QN17EabqvbTv7gBUgqHhOXF16wqi+CnwJgCU+B+iVNAHuhb76/GZOD +dVlPTD8fD0vnZZ6YbqZqzLzzTom/vghFQtszUG/e1k4P3kYDmN1bMHv6WHbT8Jg/ +2Yr6tyLbtY0iphE+JvA2Fv+n+Ju0cp+WmOhTC40tAeP/dWWjSO5/NychjkVlrYD1 +qlcn7iIC5eTCblIuB2nHwcAs9F5Yi3B9BHXrTK/GGt5IUjCcY2zIOsI9Opuw1naY +Li8u68DsPF+bxudLdmf3Q0il0l/jsDsKEKalQohwI1Qc +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEjTCCA3WgAwIBAgIQDQd4KhM/xvmlcpbhMf/ReTANBgkqhkiG9w0BAQsFADBh +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH +MjAeFw0xNzExMDIxMjIzMzdaFw0yNzExMDIxMjIzMzdaMGAxCzAJBgNVBAYTAlVT +MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j +b20xHzAdBgNVBAMTFkdlb1RydXN0IFRMUyBSU0EgQ0EgRzEwggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQC+F+jsvikKy/65LWEx/TMkCDIuWegh1Ngwvm4Q +yISgP7oU5d79eoySG3vOhC3w/3jEMuipoH1fBtp7m0tTpsYbAhch4XA7rfuD6whU +gajeErLVxoiWMPkC/DnUvbgi74BJmdBiuGHQSd7LwsuXpTEGG9fYXcbTVN5SATYq +DfbexbYxTMwVJWoVb6lrBEgM3gBBqiiAiy800xu1Nq07JdCIQkBsNpFtZbIZhsDS +fzlGWP4wEmBQ3O67c+ZXkFr2DcrXBEtHam80Gp2SNhou2U5U7UesDL/xgLK6/0d7 +6TnEVMSUVJkZ8VeZr+IUIlvoLrtjLbqugb0T3OYXW+CQU0kBAgMBAAGjggFAMIIB +PDAdBgNVHQ4EFgQUlE/UXYvkpOKmgP792PkA76O+AlcwHwYDVR0jBBgwFoAUTiJU +IBiV5uNu5g/6+rkS7QYXjzkwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsG +AQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMDQGCCsGAQUFBwEB +BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEIGA1Ud +HwQ7MDkwN6A1oDOGMWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEds +b2JhbFJvb3RHMi5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEW +HGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEB +AIIcBDqC6cWpyGUSXAjjAcYwsK4iiGF7KweG97i1RJz1kwZhRoo6orU1JtBYnjzB +c4+/sXmnHJk3mlPyL1xuIAt9sMeC7+vreRIF5wFBC0MCN5sbHwhNN1JzKbifNeP5 +ozpZdQFmkCo+neBiKR6HqIA+LMTMCMMuv2khGGuPHmtDze4GmEGZtYLyF8EQpa5Y +jPuV6k2Cr/N3XxFpT3hRpt/3usU/Zb9wfKPtWpoznZ4/44c1p9rzFcZYrWkj3A+7 +TNBJE0GmP2fhXhP1D/XVfIW/h0yCJGEiV9Glm/uGOa3DXHlmbAcxSyCRraG+ZBkA +7h4SeM6Y8l/7MBRpPCz6l8Y= +-----END CERTIFICATE----- diff --git a/ssl/tls/ct_log_list.cnf b/ssl/tls/ct_log_list.cnf new file mode 100644 index 0000000..e643cfd --- /dev/null +++ b/ssl/tls/ct_log_list.cnf @@ -0,0 +1,9 @@ +# This file specifies the Certificate Transparency logs +# that are to be trusted. + +# Google's list of logs can be found here: +# www.certificate-transparency.org/known-logs +# A Python program to convert the log list to OpenSSL's format can be +# found here: +# https://github.com/google/certificate-transparency/blob/master/python/utilities/log_list/print_log_list.py +# Use the "--openssl_output" flag. diff --git a/ssl/tls/openssl.cnf b/ssl/tls/openssl.cnf new file mode 100644 index 0000000..84a9898 --- /dev/null +++ b/ssl/tls/openssl.cnf @@ -0,0 +1,402 @@ +# +# OpenSSL example configuration file. +# See doc/man5/config.pod for more info. +# +# This is mostly being used for generation of certificate requests, +# but may be used for auto loading of providers + +# Note that you can include other files from the main configuration +# file using the .include directive. +#.include filename + +# This definition stops the following lines choking if HOME isn't +# defined. +HOME = . + +# Use this in order to automatically load providers. +openssl_conf = openssl_init + +# Comment out the next line to ignore configuration errors +config_diagnostics = 1 + +# Extra OBJECT IDENTIFIER info: +# oid_file = $ENV::HOME/.oid +oid_section = new_oids + +# To use this configuration file with the "-extfile" option of the +# "openssl x509" utility, name here the section containing the +# X.509v3 extensions to use: +# extensions = +# (Alternatively, use a configuration file that has only +# X.509v3 extensions in its main [= default] section.) + +[ new_oids ] +# We can add new OIDs in here for use by 'ca', 'req' and 'ts'. +# Add a simple OID like this: +# testoid1=1.2.3.4 +# Or use config file substitution like this: +# testoid2=${testoid1}.5.6 + +# Policies used by the TSA examples. +tsa_policy1 = 1.2.3.4.1 +tsa_policy2 = 1.2.3.4.5.6 +tsa_policy3 = 1.2.3.4.5.7 + +[openssl_init] +providers = provider_sect +# Load default TLS policy configuration +ssl_conf = ssl_module +alg_section = evp_properties + +[ evp_properties ] +#This section is intentionally added empty here +#to be tuned on particular systems + +# Uncomment the sections that start with ## below to enable the legacy provider. +# Loading the legacy provider enables support for the following algorithms: +# Hashing Algorithms / Message Digests: MD2, MD4, MDC2, WHIRLPOOL, RIPEMD160 +# Symmetric Ciphers: Blowfish, CAST, DES, IDEA, RC2, RC4,RC5, SEED +# Key Derivation Function (KDF): PBKDF1 +# In general it is not recommended to use the above mentioned algorithms for +# security critical operations, as they are cryptographically weak or vulnerable +# to side-channel attacks and as such have been deprecated. + +[provider_sect] +default = default_sect +##legacy = legacy_sect +## +[default_sect] +activate = 1 + +##[legacy_sect] +##activate = 1 + +#Place the third party provider configuration files into this folder +.include /etc/pki/tls/openssl.d + +[ ssl_module ] + +system_default = crypto_policy + +[ crypto_policy ] + +.include = /etc/crypto-policies/back-ends/opensslcnf.config + +#################################################################### +[ ca ] +default_ca = CA_default # The default ca section + +#################################################################### +[ CA_default ] + +dir = /etc/pki/CA # Where everything is kept +certs = $dir/certs # Where the issued certs are kept +crl_dir = $dir/crl # Where the issued crl are kept +database = $dir/index.txt # database index file. +#unique_subject = no # Set to 'no' to allow creation of + # several certs with same subject. +new_certs_dir = $dir/newcerts # default place for new certs. + +certificate = $dir/cacert.pem # The CA certificate +serial = $dir/serial # The current serial number +crlnumber = $dir/crlnumber # the current crl number + # must be commented out to leave a V1 CRL +crl = $dir/crl.pem # The current CRL +private_key = $dir/private/cakey.pem # The private key + +x509_extensions = usr_cert # The extensions to add to the cert + +# Comment out the following two lines for the "traditional" +# (and highly broken) format. +name_opt = ca_default # Subject Name options +cert_opt = ca_default # Certificate field options + +# Extension copying option: use with caution. +# copy_extensions = copy + +# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs +# so this is commented out by default to leave a V1 CRL. +# crlnumber must also be commented out to leave a V1 CRL. +# crl_extensions = crl_ext + +default_days = 365 # how long to certify for +default_crl_days= 30 # how long before next CRL +default_md = sha256 # use SHA-256 by default +preserve = no # keep passed DN ordering + +# A few difference way of specifying how similar the request should look +# For type CA, the listed attributes must be the same, and the optional +# and supplied fields are just that :-) +policy = policy_match + +# For the CA policy +[ policy_match ] +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +# For the 'anything' policy +# At this point in time, you must list all acceptable 'object' +# types. +[ policy_anything ] +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +#################################################################### +[ req ] +default_bits = 2048 +default_md = sha256 +default_keyfile = privkey.pem +distinguished_name = req_distinguished_name +attributes = req_attributes +x509_extensions = v3_ca # The extensions to add to the self signed cert + +# Passwords for private keys if not present they will be prompted for +# input_password = secret +# output_password = secret + +# This sets a mask for permitted string types. There are several options. +# default: PrintableString, T61String, BMPString. +# pkix : PrintableString, BMPString (PKIX recommendation before 2004) +# utf8only: only UTF8Strings (PKIX recommendation after 2004). +# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings). +# MASK:XXXX a literal mask value. +# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings. +string_mask = utf8only + +# req_extensions = v3_req # The extensions to add to a certificate request + +[ req_distinguished_name ] +countryName = Country Name (2 letter code) +countryName_default = XX +countryName_min = 2 +countryName_max = 2 + +stateOrProvinceName = State or Province Name (full name) +#stateOrProvinceName_default = Default Province + +localityName = Locality Name (eg, city) +localityName_default = Default City + +0.organizationName = Organization Name (eg, company) +0.organizationName_default = Default Company Ltd + +# we can do this but it is not needed normally :-) +#1.organizationName = Second Organization Name (eg, company) +#1.organizationName_default = World Wide Web Pty Ltd + +organizationalUnitName = Organizational Unit Name (eg, section) +#organizationalUnitName_default = + +commonName = Common Name (eg, your name or your server\'s hostname) +commonName_max = 64 + +emailAddress = Email Address +emailAddress_max = 64 + +# SET-ex3 = SET extension number 3 + +[ req_attributes ] +challengePassword = A challenge password +challengePassword_min = 4 +challengePassword_max = 20 + +unstructuredName = An optional company name + +[ usr_cert ] + +# These extensions are added when 'ca' signs a request. + +# This goes against PKIX guidelines but some CAs do it and some software +# requires this to avoid interpreting an end user certificate as a CA. + +basicConstraints=CA:FALSE + +# This is typical in keyUsage for a client certificate. +# keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +# PKIX recommendations harmless if included in all certificates. +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid,issuer + +# This stuff is for subjectAltName and issuerAltname. +# Import the email address. +# subjectAltName=email:copy +# An alternative to produce certificates that aren't +# deprecated according to PKIX. +# subjectAltName=email:move + +# Copy subject details +# issuerAltName=issuer:copy + +# This is required for TSA certificates. +# extendedKeyUsage = critical,timeStamping + +[ v3_req ] + +# Extensions to add to a certificate request + +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +[ v3_ca ] + + +# Extensions for a typical CA + + +# PKIX recommendation. + +subjectKeyIdentifier=hash + +authorityKeyIdentifier=keyid:always,issuer + +basicConstraints = critical,CA:true + +# Key usage: this is typical for a CA certificate. However since it will +# prevent it being used as an test self-signed certificate it is best +# left out by default. +# keyUsage = cRLSign, keyCertSign + +# Include email address in subject alt name: another PKIX recommendation +# subjectAltName=email:copy +# Copy issuer details +# issuerAltName=issuer:copy + +# DER hex encoding of an extension: beware experts only! +# obj=DER:02:03 +# Where 'obj' is a standard or added object +# You can even override a supported extension: +# basicConstraints= critical, DER:30:03:01:01:FF + +[ crl_ext ] + +# CRL extensions. +# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL. + +# issuerAltName=issuer:copy +authorityKeyIdentifier=keyid:always + +[ proxy_cert_ext ] +# These extensions should be added when creating a proxy certificate + +# This goes against PKIX guidelines but some CAs do it and some software +# requires this to avoid interpreting an end user certificate as a CA. + +basicConstraints=CA:FALSE + +# This is typical in keyUsage for a client certificate. +# keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +# PKIX recommendations harmless if included in all certificates. +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid,issuer + +# This stuff is for subjectAltName and issuerAltname. +# Import the email address. +# subjectAltName=email:copy +# An alternative to produce certificates that aren't +# deprecated according to PKIX. +# subjectAltName=email:move + +# Copy subject details +# issuerAltName=issuer:copy + +# This really needs to be in place for it to be a proxy certificate. +proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo + +#################################################################### +[ tsa ] + +default_tsa = tsa_config1 # the default TSA section + +[ tsa_config1 ] + +# These are used by the TSA reply generation only. +dir = /etc/pki/CA # TSA root directory +serial = $dir/tsaserial # The current serial number (mandatory) +crypto_device = builtin # OpenSSL engine to use for signing +signer_cert = $dir/tsacert.pem # The TSA signing certificate + # (optional) +certs = $dir/cacert.pem # Certificate chain to include in reply + # (optional) +signer_key = $dir/private/tsakey.pem # The TSA private key (optional) +signer_digest = sha256 # Signing digest to use. (Optional) +default_policy = tsa_policy1 # Policy if request did not specify it + # (optional) +other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional) +digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory) +accuracy = secs:1, millisecs:500, microsecs:100 # (optional) +clock_precision_digits = 0 # number of digits after dot. (optional) +ordering = yes # Is ordering defined for timestamps? + # (optional, default: no) +tsa_name = yes # Must the TSA name be included in the reply? + # (optional, default: no) +ess_cert_id_chain = no # Must the ESS cert id chain be included? + # (optional, default: no) +ess_cert_id_alg = sha256 # algorithm to compute certificate + # identifier (optional, default: sha256) + +[insta] # CMP using Insta Demo CA +# Message transfer +server = pki.certificate.fi:8700 +# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080 +# tls_use = 0 +path = pkix/ + +# Server authentication +recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer +ignore_keyusage = 1 # potentially needed quirk +unprotected_errors = 1 # potentially needed quirk +extracertsout = insta.extracerts.pem + +# Client authentication +ref = 3078 # user identification +secret = pass:insta # can be used for both client and server side + +# Generic message options +cmd = ir # default operation, can be overridden on cmd line with, e.g., kur + +# Certificate enrollment +subject = "/CN=openssl-cmp-test" +newkey = insta.priv.pem +out_trusted = apps/insta.ca.crt # does not include keyUsage digitalSignature +certout = insta.cert.pem + +[pbm] # Password-based protection for Insta CA +# Server and client authentication +ref = $insta::ref # 3078 +secret = $insta::secret # pass:insta + +[signature] # Signature-based protection for Insta CA +# Server authentication +trusted = $insta::out_trusted # apps/insta.ca.crt + +# Client authentication +secret = # disable PBM +key = $insta::newkey # insta.priv.pem +cert = $insta::certout # insta.cert.pem + +[ir] +cmd = ir + +[cr] +cmd = cr + +[kur] +# Certificate update +cmd = kur +oldcert = $insta::certout # insta.cert.pem + +[rr] +# Certificate revocation +cmd = rr +oldcert = $insta::certout # insta.cert.pem diff --git a/ssl/tls/private/wildcard.pixelpark.com-key.pem b/ssl/tls/private/wildcard.pixelpark.com-key.pem new file mode 100644 index 0000000..748209a --- /dev/null +++ b/ssl/tls/private/wildcard.pixelpark.com-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQClv48VGasSbsTY +CxGqbQj973Uyz81WjQhfEAAbtiZN7wMJsjk++RV5xsgIFSLMODeg6pLAyA7WbPzX +3wpE+mKQcK1/pCfm9dMnTbqsABCBdblNHwB8nNnqqz8a9EJNtFmBbWxYGajplvNP +c2MGv7q+hPni6VUmDDnI/gbZzCQJ2sN4u2hK/qF867mTM6fC03A3msFDLuxPnPUn +STU+nvDWkwGuHAPBL9OzMWWh5IHLPEw9vw342tMf+AZgtHMcJ+NJ2UYOYAKL9SPe +BQwNXxbnZjI72Oa6s9cMpAK4g92jCE0ZRHBbHBcU7H273QGBP7Kj5WPCSG82LFMx +HyMXxltHAgMBAAECggEAPKS+ard2Bqv9nJhMMeFsAVEcPeeXFxxJ3FJD39/A2xHg +uCr71AUZrPEkngRxs2u8OsWoxR1NhHni9u7V2JAOARAhAssiiFgYFlDTxHvPjjZv +An8d0/olpz1ZvPhyy/B5MShClGdrDHBc/IxYxo7e+jc4IKRDscSWXepHwmd1Jh9L ++k6S98B6TlL1GX/Hyk3FbSE26CwRJA8P405b8F2SR70cQ7ofGK4e78c7YauwbjSs +B0Q1z0HRZdTlwy8I36TxuACnRqA+3NITwmm/SMqzXztZTwcqhOAkYYKiaW1ACe2V +5ct9FtwdpHGSQCJxyfCHE1wEbMNDiHrEqh2WdSnz0QKBgQDdC8OCHOxff75hXX4w +6UVbB0RD4ApdLfwxaHIJcvSgju9XJx+WNhifW41yPcx6wqYhDR2tf8ZlH5AtKLGA +F3IoK5muqHhjGc6rEYIIx8FkViskMZEQuGvHcCDAXhk9i0Yq9FHdZukBz3kFXxj+ +58SA0ezFoEcSi+1MTfa1l47ldwKBgQC/9UVwC0MVu5cZSja9WXNEV2lOZwNifMNy +alSF/yP/7V4cRgnVc6zjqcP6TK96ukZ9T+t8Lvgpp/XqhitF1lxo4pMxqUmevZV2 +C2UK4NqZLLNwiPhqPLzKym+2O3r7Ub1Xc7fO1qf+PfWbI1NRaadXNaYXvidjNljf +XXvFXRDssQKBgF7jXuDq05lHOA2J2dLbQFeMLgTJFwna5Ki9Aj8GJvcJhLqv48JS +pI07+uMwnieQiUok3DmPYTYlr3mDP3cSGYIe/VDZpxw7htkuodhtD5qn1sspr/Ey +ianKe3S4sDMYJ13nFYFqXNnXG0dwBEXgbh0ygGZxoDDY+lvIGADp94CPAoGBAIqI +d0lqR0rq7BwrTCAQ6zgaIXycqXutcNwk0sU1ogR0iSO8hCJQ7igLf80nBMl8n5yW +Tet8dkqR1c8gbyBimKR1SCdh9iiix7e+d3iHWBuNgB6qKyV4mgN8X2zTtmij0BLK +B5A1qF2614LT1rB9oHA23pxp9kEKms7wx39jL/CxAoGAZKElhzU4Jg0rgENTgycv +SLr/pqZEEqmr7wFnnehRRMvY5C9nxgF2RigyWgPfeWWPjm8m20u2oJosH2CahDRf +DzVZZaKTY6snbx3oMSYn75nw//7JYS67Mzgp6PvaanrWZvaBR4bZ1UKGxjHoDdGT +NTF4+yvv3trvfYjyi27lZmA= +-----END PRIVATE KEY----- diff --git a/ssl/tls/private/wildcard.pixelpark.net-key.pem b/ssl/tls/private/wildcard.pixelpark.net-key.pem new file mode 100644 index 0000000..f8fa166 --- /dev/null +++ b/ssl/tls/private/wildcard.pixelpark.net-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCOXX+nBrk6GK4S +0vM3gKhMic0i+axx8eOtXilx2+BfvNCgicyUFDCbuLntc/vxZkVUOVHppdx1PKaI +JMWYIwudbkbutPdcC0dByaIw05lwxKJENwaQIPcMI4zGAX/Ys8J+nSnIbWSBtc/O +ijyXMYRC+E5xL5ZofqM3hsKVcNo3pYIKBkNK97W3WhEyJQwexbXRI1z/4SdIMVLo +g1+i0cHPPXOqrCbkC6pmuCFbNum0TxjZLkh0K/d9/HSWjUbsn/mAxFwZ0xM6NcOe +fp9rchcvrkghVdBTFY9ubrBtQ3b+xcklc3dOLOZKuBvHQ/9IO+5ADQmzHLdFrkvi +w8NA+gbzAgMBAAECggEAImrwRY0WkrkMvHhLXIu6JGbcNSxvSEzWYj91fZVOtVaM +iYNG9jW7WqpaKNH1gvLap/YDm50Bo0Y6bIeXTaSLVlAmzebqNlJzs6/viiZd3ilr +oVo8N/QAResCSYxrQBSVXM7aHx5zQfiWeLRq2ZKbCyXEsRB0KGcVRoNJ358c4n7A +lf5klIfNfzSBQ+86XJ6+Fu3ndHjO4VNapVtCjf0xfOI6YdzJa+cJyoqyKiwtJPFJ +G3lCDhMlWTWOIQqAtde1mdIwOaC9lNO/c+Vk3cYnwxlZ1MenAiDyXHkGhCceQNfO +LTnKvMK7fPfaK7979A8tBdfQggg6YB2YWTyTQfEFIQKBgQDAbjXJbdXNHATHbh1p +N6z8EYQzDD5b0CrBzWTYPWLAdkldHGM71Eqn2PlFwXqyo651QzUkDV3BDybCVqkX +tSWSmZWso/HBS37segEu2AlPQwfA/XbVT6yv/ZMM0+GX4aQKR9smNfvbSKHVtHOr +6OCwdtlj9obdJkeug4i2BRlSzwKBgQC9ZUhz3t8MXP9SjGAT8Xv0Jaw+yfH6KXbD +5MyUTVSlBaZZk2dvabYweu4n2Z3Zl3iqGejlND7Owq2BzLXQ+vo/13sLj7dz1oVk +0UwdWHt/tlfbpFTvF7RJzJP7BlKD69my5HJADjb8JecbjaYghBSVR1ikepYKEprD +hczI4RFinQKBgQCqCfkfaB3v491ZOLVmf1stVnEiBqSnztepb0y4Q+4aMav8ShRq +Dtp1XSZP/HrmlfqYBe5UUDdTXIccXSWIHHr6AxsedbQv4P1kCx82fJIlZw7X+2Fh +dskarpCdWjFTW4Dv0LUXG8bU62aOB6na86pwZGUOjw53Jtdan0JTzUemQwKBgAhz +OGRTEUiP7aRVNwQsxgcCl0jF4dHzf6UF1ErZmGk0c1OTzA2gfcxz76Q/hVdr9qpA +Na/kQNkgvnUIGSSVzgyDJK5DXz//1jvFSswUYo40KH9YOaHhQN36DrAofA3+u9vL +bX2GJNXjKwiDrWHOAs0WPdI41fDlG5qVoalkwU3RAoGADEoyXvt4hFIs1tNyT56M +jEqJHBKHziY2SwWMyO8RvZP82CY6iezYCIGD5KqpdR+K3saW+yChPXTxGWXx+auU +KKSDkN0HC1vszurHgmDo7Zu9D3RArgFLA7jSk8BVGqF86z4P12QMlZRguaEwO2xS +e8qG+nnE/rgG5d2LYzv53+Q= +-----END PRIVATE KEY----- -- 2.39.5