-
Notifications
You must be signed in to change notification settings - Fork 139
/
Copy pathdefault.cfg
715 lines (615 loc) · 26.6 KB
/
default.cfg
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
###############################################################################
## Default Configuration: ##
## ##
## Values in this section are common to more than one PKI subsystem, and ##
## contain required information which MAY be overridden by users as ##
## necessary. ##
## ##
## There are also some meta-parameters that determine how the PKI ##
## configuratiion should work. ##
## ##
###############################################################################
[DEFAULT]
JAVA_HOME=%(java_home)s
# The sensitive_parameters contains a list of parameters which may contain
# sensitive information which must not be displayed to the console nor stored
# in log files for security reasons.
sensitive_parameters=
pki_admin_password
pki_backup_password
pki_client_database_password
pki_client_pin
pki_client_pkcs12_password
pki_clone_pkcs12_password
pki_ds_password
pki_external_pkcs12_password
pki_pkcs12_password
pki_one_time_pin
pki_pin
pki_replication_password
pki_security_domain_password
pki_server_database_password
pki_server_pkcs12_password
pki_token_password
acme_database_bind_password
acme_database_password
acme_issuer_password
acme_realm_bind_password
acme_realm_password
est_realm_bind_password
est_realm_password
est_ca_password
pki_instance_name=pki-tomcat
pki_http_port=8080
pki_https_port=8443
pki_admin_setup=True
pki_admin_cert_file=%(pki_client_dir)s/ca_admin.cert
pki_admin_cert_request_type=pkcs10
pki_admin_dualkey=False
pki_admin_key_algorithm=SHA256withRSA
# DEPRECATED: Use 'pki_admin_key_size' instead.
pki_admin_keysize=2048
pki_admin_key_size=%(pki_admin_keysize)s
pki_admin_key_type=rsa
pki_admin_password=
pki_audit_group=pkiaudit
pki_audit_signing_key_algorithm=SHA256withRSA
pki_audit_signing_key_size=2048
pki_audit_signing_key_type=rsa
pki_audit_signing_signing_algorithm=SHA256withRSA
pki_audit_signing_token=
pki_audit_signing_opFlags=
pki_audit_signing_opFlagsMask=
pki_backup_keys=False
pki_backup_file=
pki_backup_password=
pki_ca_signing_nickname=caSigningCert cert-%(pki_instance_name)s CA
# DEPRECATED: Use 'pki_ca_signing_cert_path' instead.
pki_external_ca_cert_path=
pki_ca_signing_cert_path=%(pki_external_ca_cert_path)s
pki_client_admin_cert_p12=%(pki_client_dir)s/%(pki_subsystem_type)s_admin_cert.p12
pki_client_database_password=
pki_client_database_purge=True
pki_client_dir=%(home_dir)s/.dogtag/%(pki_instance_name)s
pki_client_pkcs12_password=
pki_ds_bind_dn=cn=Directory Manager
pki_ds_create_new_db=True
# DEPRECATED: Use 'pki_ds_url' instead.
pki_ds_ldap_port=389
pki_ds_ldaps_port=636
pki_ds_secure_connection=False
pki_ds_password=
pki_ds_remove_data=True
pki_ds_secure_connection_ca_nickname=Directory Server CA certificate
pki_ds_secure_connection_ca_pem_file=
pki_group=pkiuser
pki_hsm_enable=False
pki_hsm_libfile=
pki_hsm_modulename=
pki_issuing_ca_hostname=%(pki_security_domain_hostname)s
pki_issuing_ca_https_port=%(pki_security_domain_https_port)s
pki_issuing_ca_uri=https://%(pki_issuing_ca_hostname)s:%(pki_issuing_ca_https_port)s
pki_issuing_ca=%(pki_issuing_ca_uri)s
pki_replication_password=
pki_status_request_timeout=
pki_security_domain_hostname=%(pki_hostname)s
pki_security_domain_https_port=8443
pki_security_domain_uri=https://%(pki_security_domain_hostname)s:%(pki_security_domain_https_port)s
pki_security_domain_name=%(pki_dns_domainname)s Security Domain
pki_security_domain_password=
pki_security_domain_user=caadmin
#for supporting server cert SAN injection
pki_san_inject=False
pki_san_for_server_cert=
pki_skip_configuration=False
pki_skip_ds_verify=False
pki_skip_installation=False
pki_skip_sd_verify=False
# DEPRECATED
# Use 'pki_sslserver_*' instead.
pki_ssl_server_key_algorithm=SHA256withRSA
pki_ssl_server_key_size=2048
pki_ssl_server_key_type=rsa
pki_ssl_server_nickname=Server-Cert cert-%(pki_instance_name)s
pki_ssl_server_subject_dn=cn=%(pki_hostname)s,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_ssl_server_token=
pki_sslserver_key_algorithm=%(pki_ssl_server_key_algorithm)s
pki_sslserver_signing_algorithm=SHA256withRSA
pki_sslserver_key_size=%(pki_ssl_server_key_size)s
pki_sslserver_key_type=%(pki_ssl_server_key_type)s
pki_sslserver_nickname=%(pki_ssl_server_nickname)s
pki_sslserver_subject_dn=%(pki_ssl_server_subject_dn)s
pki_sslserver_token=%(pki_ssl_server_token)s
pki_sslserver_opFlags=
pki_sslserver_opFlagsMask=
pki_self_signed_nickname=temp %(pki_sslserver_nickname)s
pki_self_signed_token=
pki_subsystem_key_algorithm=SHA256withRSA
pki_subsystem_signing_algorithm=SHA256withRSA
pki_subsystem_key_size=2048
pki_subsystem_key_type=rsa
pki_subsystem_nickname=subsystemCert cert-%(pki_instance_name)s
pki_subsystem_subject_dn=cn=Subsystem Certificate,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_subsystem_token=
pki_subsystem_opFlags=
pki_subsystem_opFlagsMask=
#Set this if we want to use PSS signing when RSA is specified
pki_use_pss_rsa_signing_algorithm=False
#Set this if we want ot use the OAEP key wrap alg.
pki_use_oaep_rsa_keywrap=False
pki_token_name=
pki_token_password=
pki_user=pkiuser
# DEPRECATED: Use 'pki_cert_chain_path' instead.
pki_external_ca_cert_chain_path=
# In addition to specifying an external CA certificate, this parameter
# can be used with a one-shot installation process is used for installing
# non-CA subsystems on a new host, lacking any existing subsystems. This
# cert is used to establish trust to an existing CA installation on another
# system.
pki_cert_chain_path=%(pki_external_ca_cert_chain_path)s
# DEPRECATED: Use 'pki_cert_chain_nickname' instead.
pki_external_ca_cert_chain_nickname=caSigningCert External CA
pki_cert_chain_nickname=%(pki_external_ca_cert_chain_nickname)s
# DEPRECATED: Use 'pki_server_database_password' instead.
pki_pin=
pki_pkcs12_path=
pki_pkcs12_password=
# Paths:
# These are used in the processing of pkispawn and are not supposed
# to be overwritten by user configuration files.
#
pki_client_database_dir=%(pki_client_subsystem_dir)s/alias
pki_client_subsystem_dir=%(pki_client_dir)s/%(pki_subsystem_type)s
pki_client_password_conf=%(pki_client_subsystem_dir)s/password.conf
pki_client_pkcs12_password_conf=%(pki_client_subsystem_dir)s/pkcs12_password.conf
pki_client_admin_cert=%(pki_client_dir)s/%(pki_subsystem_type)s_admin.cert
pki_instance_path=/var/lib/pki/%(pki_instance_name)s
###############################################################################
## Tomcat Configuration: ##
## ##
## Values in this section are common to PKI subsystems that run ##
## as an instance of 'Tomcat' (CA, KRA, OCSP, TKS, and TPS subsystems ##
## including 'Clones', 'Subordinate CAs', and 'External CAs'), and contain ##
## required information which MAY be overridden by users as necessary. ##
## ##
## PKI CLONES: To specify a 'CA Clone', a 'KRA Clone', an 'OCSP Clone', ##
## a 'TKS Clone', or a 'TPS Clone', change the value of ##
## 'pki_clone' from 'False' to 'True'. ##
## ##
## REMINDER: PKI CA Clones, Subordinate CAs, and External CAs ##
## are MUTUALLY EXCLUSIVE entities!!! ##
###############################################################################
[Tomcat]
# Note: see Tomcat CVE 2020-1938. It is strongly recommended to leave
# pki_ajp_host as localhost. If trying to use AJP over a reverse proxy from
# another host, manually edit server.xml to specify a shared secret or
# tunnel it over a secure network. Refer to the Tomcat documentation for more
# information about secure Tomcat configuration.
# Note: pki_ajp_host is deprecated in favor of pki_ajp_host_ipv4.
pki_ajp_host=localhost4
pki_ajp_host_ipv4=%(pki_ajp_host)s
pki_ajp_host_ipv6=localhost6
pki_ajp_port=8009
pki_ajp_secret=%(pki_random_ajp_secret)s
pki_server_pkcs12_path=
pki_server_pkcs12_password=
pki_server_external_certs_path=
pki_clone=False
pki_clone_pkcs12_password=
pki_clone_pkcs12_path=
pki_clone_replicate_schema=True
pki_clone_replication_master_port=
pki_clone_replication_clone_port=
pki_clone_replication_security=None
pki_clone_setup_replication=True
pki_clone_reindex_data=False
pki_master_hostname=%(pki_security_domain_hostname)s
pki_master_https_port=%(pki_security_domain_https_port)s
pki_clone_uri=https://%(pki_master_hostname)s:%(pki_master_https_port)s
pki_enable_access_log=True
pki_enable_java_debugger=False
pki_enable_on_system_boot=True
pki_enable_proxy=False
pki_proxy_http_port=80
pki_proxy_https_port=443
pki_security_manager=true
pki_tomcat_server_port=8005
pki_http_enable=True
# Paths
# These are used in the processing of pkispawn and are not supposed
# to be overwritten by user configuration files.
#
pki_systemd_service_create=True
CATALINA_HOME=/usr/share/tomcat
pki_tomcat_bin_path=%(CATALINA_HOME)s/bin
pki_tomcat_lib_path=%(CATALINA_HOME)s/lib
###############################################################################
## CA Configuration: ##
## ##
## Values in this section are common to CA subsystems including 'PKI CAs', ##
## 'Cloned CAs', 'Subordinate CAs', and 'External CAs', and contain ##
## required information which MAY be overridden by users as necessary. ##
## ##
## EXTERNAL CAs: To specify an 'External CA', change the value ##
## of 'pki_external' from 'False' to 'True'. ##
## ##
## SUBORDINATE CAs: To specify a 'Subordinate CA', change the value ##
## of 'pki_subordinate' from 'False' to 'True'. ##
## ##
## REMINDER: PKI CA Clones, Subordinate CAs, and External CAs ##
## are MUTUALLY EXCLUSIVE entities!!! ##
###############################################################################
[CA]
pki_ca_signing_key_algorithm=SHA256withRSA
pki_ca_signing_key_size=3072
pki_ca_signing_key_type=rsa
pki_ca_signing_record_create=True
pki_ca_signing_serial_number=1
pki_ca_signing_signing_algorithm=SHA256withRSA
pki_ca_signing_subject_dn=cn=CA Signing Certificate,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_ca_signing_token=
pki_ca_signing_opFlags=
pki_ca_signing_opFlagsMask=
# DEPRECATED: Use 'pki_ca_signing_csr_path' instead.
pki_external_csr_path=
pki_ca_signing_csr_path=%(pki_external_csr_path)s
pki_ocsp_signing_csr_path=
pki_audit_signing_csr_path=
pki_sslserver_csr_path=
pki_subsystem_csr_path=
pki_ocsp_signing_cert_path=
pki_audit_signing_cert_path=
pki_sslserver_cert_path=
pki_subsystem_cert_path=
pki_ca_starting_crl_number=0
pki_external=False
pki_req_ext_add=False
pki_req_ext_oid=
pki_req_ext_critical=False
pki_req_ext_data=
pki_external_step_two=False
pki_external_pkcs12_path=%(pki_pkcs12_path)s
pki_external_pkcs12_password=%(pki_pkcs12_password)s
pki_import_system_certs=True
pki_import_admin_cert=False
pki_ocsp_signing_key_algorithm=SHA256withRSA
pki_ocsp_signing_key_size=3072
pki_ocsp_signing_key_type=rsa
pki_ocsp_signing_nickname=ocspSigningCert cert-%(pki_instance_name)s CA
pki_ocsp_signing_signing_algorithm=SHA256withRSA
pki_ocsp_signing_subject_dn=cn=CA OCSP Signing Certificate,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_ocsp_signing_token=
pki_ocsp_signing_opFlags=
pki_ocsp_signing_opFlagsMask=
pki_profiles_in_ldap=False
pki_random_serial_numbers_enable=False
pki_subordinate=False
pki_subordinate_create_new_security_domain=False
pki_subordinate_security_domain_name=%(pki_dns_domainname)s Subordinate Security Domain
pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
pki_admin_name=%(pki_admin_uid)s
pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_admin_uid=caadmin
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s CA
pki_audit_signing_subject_dn=cn=CA Audit Signing Certificate,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_ds_setup=True
pki_ds_base_dn=o=%(pki_instance_name)s-CA
pki_ds_database=%(pki_instance_name)s-CA
# DEPRECATED: Use 'pki_ds_url' instead.
pki_ds_hostname=%(pki_hostname)s
pki_subsystem_name=CA %(pki_hostname)s %(pki_https_port)s
pki_share_db=False
pki_master_crl_enable=True
# Default OCSP URI added by AuthInfoAccessExtDefault if the profile
# config is blank. If both are blank, the value is constructed
# based on the CMS hostname and port.
pki_default_ocsp_uri=
pki_serial_number_range_start=
pki_serial_number_range_end=
pki_serial_number_range_increment=
pki_serial_number_range_minimum=
pki_serial_number_range_transfer=
pki_request_number_range_start=
pki_request_number_range_end=
pki_request_number_range_increment=
pki_request_number_range_minimum=
pki_request_number_range_transfer=
pki_replica_number_range_start=
pki_replica_number_range_end=
# Cert cert ID generator: legacy, legacy2, random
pki_cert_id_generator=random
# Cert cert ID length in bits
pki_cert_id_length=128
# Cert request ID generator: legacy, legacy2, random
pki_request_id_generator=random
# Cert request ID length in bits
pki_request_id_length=128
pki_security_domain_setup=True
pki_registry_enable=True
###############################################################################
## KRA Configuration: ##
## ##
## Values in this section are common to KRA subsystems ##
## including 'PKI KRAs', 'Cloned KRAs', and 'Stand-alone KRAs' and contain ##
## required information which MAY be overridden by users as necessary. ##
## ##
## STAND-ALONE KRAs: To specify a 'Stand-alone KRA', change the value ##
## of 'pki_standalone' from 'False' to 'True', and ##
## specify the various 'pki_external' parameters ##
## as appropriate. ##
## ##
###############################################################################
[KRA]
pki_import_admin_cert=True
pki_standalone=False
pki_kra_ephemeral_requests=False
# DEPRECATED
# Use 'pki_*_csr_path' instead.
pki_external_admin_csr_path=
pki_external_audit_signing_csr_path=
pki_external_sslserver_csr_path=
pki_external_storage_csr_path=
pki_external_subsystem_csr_path=
pki_external_transport_csr_path=
pki_admin_csr_path=%(pki_external_admin_csr_path)s
pki_audit_signing_csr_path=%(pki_external_audit_signing_csr_path)s
pki_sslserver_csr_path=%(pki_external_sslserver_csr_path)s
pki_storage_csr_path=%(pki_external_storage_csr_path)s
pki_subsystem_csr_path=%(pki_external_subsystem_csr_path)s
pki_transport_csr_path=%(pki_external_transport_csr_path)s
pki_external_step_two=False
# DEPRECATED
# Use 'pki_*_cert_path' instead.
pki_external_admin_cert_path=
pki_external_audit_signing_cert_path=
pki_external_sslserver_cert_path=
pki_external_storage_cert_path=
pki_external_subsystem_cert_path=
pki_external_transport_cert_path=
pki_admin_cert_path=%(pki_external_admin_cert_path)s
pki_audit_signing_cert_path=%(pki_external_audit_signing_cert_path)s
pki_sslserver_cert_path=%(pki_external_sslserver_cert_path)s
pki_storage_cert_path=%(pki_external_storage_cert_path)s
pki_subsystem_cert_path=%(pki_external_subsystem_cert_path)s
pki_transport_cert_path=%(pki_external_transport_cert_path)s
pki_storage_key_algorithm=SHA256withRSA
pki_storage_key_size=2048
pki_storage_key_type=rsa
pki_storage_nickname=storageCert cert-%(pki_instance_name)s KRA
pki_storage_signing_algorithm=SHA256withRSA
pki_storage_subject_dn=cn=DRM Storage Certificate,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_storage_token=
pki_storage_opFlags=
pki_storage_opFlagsMask=
pki_transport_key_algorithm=SHA256withRSA
pki_transport_key_size=2048
pki_transport_key_type=rsa
pki_transport_nickname=transportCert cert-%(pki_instance_name)s KRA
pki_transport_signing_algorithm=SHA256withRSA
pki_transport_subject_dn=cn=DRM Transport Certificate,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_transport_token=
pki_transport_opFlags=
pki_transport_opFlagsMask=
pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
pki_admin_name=%(pki_admin_uid)s
pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_admin_uid=kraadmin
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s KRA
pki_audit_signing_subject_dn=cn=KRA Audit Signing Certificate,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_ds_setup=True
pki_ds_base_dn=o=%(pki_instance_name)s-KRA
pki_ds_database=%(pki_instance_name)s-KRA
# DEPRECATED: Use 'pki_ds_url' instead.
pki_ds_hostname=%(pki_hostname)s
pki_subsystem_name=KRA %(pki_hostname)s %(pki_https_port)s
pki_share_db=True
pki_share_dbuser_dn=uid=pkidbuser,ou=people,%(pki_ds_base_dn)s
# Key ID generator: legacy, random
pki_key_id_generator=random
# Key ID length in bits
pki_key_id_length=128
# Key request ID generator: legacy, legacy2, random
pki_request_id_generator=random
# Key request ID length in bits
pki_request_id_length=128
pki_security_domain_setup=True
pki_registry_enable=True
###############################################################################
## OCSP Configuration: ##
## ##
## Values in this section are common to OCSP subsystems ##
## including 'PKI OCSPs', 'Cloned OCSPs', and 'Stand-alone OCSPs' and ##
## contain required information which MAY be overridden by users as ##
## necessary. ##
## ##
## STAND-ALONE OCSPs: To specify a 'Stand-alone OCSP', change the ##
## value of 'pki_standalone' from 'False' to ##
## 'True', and specify the various 'pki_external' ##
## parameters as appropriate. ##
## (NOTE: Stand-alone OCSP is not yet supported!) ##
## ##
###############################################################################
[OCSP]
pki_import_admin_cert=True
pki_standalone=False
# DEPRECATED
# Use 'pki_*_csr_path' instead.
pki_external_admin_csr_path=
pki_external_audit_signing_csr_path=
pki_external_signing_csr_path=
pki_external_sslserver_csr_path=
pki_external_subsystem_csr_path=
pki_admin_csr_path=%(pki_external_admin_csr_path)s
pki_audit_signing_csr_path=%(pki_external_audit_signing_csr_path)s
pki_ocsp_signing_csr_path =%(pki_external_signing_csr_path)s
pki_sslserver_csr_path=%(pki_external_sslserver_csr_path)s
pki_subsystem_csr_path=%(pki_external_subsystem_csr_path)s
pki_external_step_two=False
# DEPRECATED
# Use 'pki_*_cert_path' instead.
pki_external_admin_cert_path=
pki_external_audit_signing_cert_path=
pki_external_signing_cert_path=
pki_external_sslserver_cert_path=
pki_external_subsystem_cert_path=
pki_admin_cert_path=%(pki_external_admin_cert_path)s
pki_audit_signing_cert_path=%(pki_external_audit_signing_cert_path)s
pki_ocsp_signing_cert_path=%(pki_external_signing_cert_path)s
pki_sslserver_cert_path=%(pki_external_sslserver_cert_path)s
pki_subsystem_cert_path=%(pki_external_subsystem_cert_path)s
pki_ocsp_signing_key_algorithm=SHA256withRSA
pki_ocsp_signing_key_size=3072
pki_ocsp_signing_key_type=rsa
pki_ocsp_signing_nickname=ocspSigningCert cert-%(pki_instance_name)s OCSP
pki_ocsp_signing_signing_algorithm=SHA256withRSA
pki_ocsp_signing_subject_dn=cn=OCSP Signing Certificate,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_ocsp_signing_token=
pki_ocsp_signing_opFlags=
pki_ocsp_signing_opFlagsMask=
pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
pki_admin_name=%(pki_admin_uid)s
pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_admin_uid=ocspadmin
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s OCSP
pki_audit_signing_subject_dn=cn=OCSP Audit Signing Certificate,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_ds_setup=True
pki_ds_base_dn=o=%(pki_instance_name)s-OCSP
pki_ds_database=%(pki_instance_name)s-OCSP
# DEPRECATED: Use 'pki_ds_url' instead.
pki_ds_hostname=%(pki_hostname)s
pki_subsystem_name=OCSP %(pki_hostname)s %(pki_https_port)s
pki_share_db=True
pki_share_dbuser_dn=uid=pkidbuser,ou=people,%(pki_ds_base_dn)s
pki_security_domain_setup=True
pki_registry_enable=True
###############################################################################
## TKS Configuration: ##
## ##
## Values in this section are common to TKS subsystems ##
## including 'PKI TKSs' and 'Cloned TKSs', and contain ##
## required information which MAY be overridden by users as necessary. ##
###############################################################################
[TKS]
pki_import_admin_cert=True
pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
pki_admin_name=%(pki_admin_uid)s
pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_admin_uid=tksadmin
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s TKS
pki_audit_signing_subject_dn=cn=TKS Audit Signing Certificate,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_ds_setup=True
pki_ds_base_dn=o=%(pki_instance_name)s-TKS
pki_ds_database=%(pki_instance_name)s-TKS
# DEPRECATED: Use 'pki_ds_url' instead.
pki_ds_hostname=%(pki_hostname)s
pki_subsystem_name=TKS %(pki_hostname)s %(pki_https_port)s
pki_share_db=True
pki_share_dbuser_dn=uid=pkidbuser,ou=people,%(pki_ds_base_dn)s
pki_security_domain_setup=True
pki_registry_enable=True
###############################################################################
## TPS Configuration: ##
## ##
## Values in this section are common to PKI TPS subsystems, and contain ##
## required information which MAY be overridden by users as necessary. ##
###############################################################################
[TPS]
pki_import_admin_cert=True
pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
pki_admin_name=%(pki_admin_uid)s
pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_admin_uid=tpsadmin
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s TPS
pki_audit_signing_subject_dn=cn=TPS Audit Signing Certificate,ou=%(pki_instance_name)s,o=%(pki_security_domain_name)s
pki_ds_setup=True
pki_ds_base_dn=o=%(pki_instance_name)s-TPS
pki_ds_database=%(pki_instance_name)s-TPS
# DEPRECATED: Use 'pki_ds_url' instead.
pki_ds_hostname=%(pki_hostname)s
pki_subsystem_name=TPS %(pki_hostname)s %(pki_https_port)s
pki_authdb_hostname=%(pki_hostname)s
pki_authdb_port=389
pki_authdb_secure_conn=False
pki_ca_uri=https://%(pki_hostname)s:%(pki_https_port)s
pki_kra_uri=https://%(pki_hostname)s:%(pki_https_port)s
pki_tks_uri=https://%(pki_hostname)s:%(pki_https_port)s
pki_enable_server_side_keygen=False
pki_import_shared_secret=False
pki_share_db=True
pki_share_dbuser_dn=uid=pkidbuser,ou=people,%(pki_ds_base_dn)s
pki_source_phone_home_xml=/usr/share/pki/%(pki_subsystem_type)s/conf/phoneHome.xml
pki_security_domain_setup=True
pki_registry_enable=True
[ACME]
pki_ds_setup=False
pki_security_domain_setup=False
pki_registry_enable=True
# Database params:
# - acme_database_type
# - acme_database_url
# - acme_database_auth_type
# - acme_database_bind_dn
# - acme_database_bind_password
# - acme_database_bind_nickname
# - acme_database_user
# - acme_database_password
# - acme_database_base_dn
#
# See /usr/share/pki/acme/database/<type>/database.conf
# Issuer params:
# - acme_issuer_type
# - acme_issuer_url
# - acme_issuer_nickname
# - acme_issuer_extensions
# - acme_issuer_username
# - acme_issuer_password
# - acme_issuer_password_file
# - acme_issuer_profile
#
# See /usr/share/pki/acme/issuer/<type>/issuer.conf
# Realm params:
# - acme_realm_type
# - acme_realm_url
# - acme_realm_auth_type
# - acme_realm_bind_dn
# - acme_realm_bind_password
# - acme_realm_nickname
# - acme_realm_user
# - acme_realm_username
# - acme_realm_password
# - acme_realm_users_dn
# - acme_realm_groups_dn
#
# See /usr/share/pki/acme/realm/<type>/realm.conf
[EST]
pki_ds_setup=False
pki_share_db=False
pki_security_domain_setup=False
pki_registry_enable=True
pki_ca_uri=https://%(pki_hostname)s:%(pki_https_port)s
pki_audit_signing_nickname=
est_ca_profile=estServiceCert
est_ca_user_name=
est_ca_user_password=
est_ca_user_password_file=
est_ca_user_certificate=
est_realm_type=
est_realm_custom=
est_realm_url=
est_realm_auth_type=BasicAuth
est_realm_bind_dn=cn=Directory Manager
est_realm_bind_password=
est_realm_nickname=
est_realm_user=
est_realm_username=
est_realm_password=
est_realm_users_dn=ou=people,dc=est,dc=pki,dc=example,dc=com
est_realm_groups_dn=ou=groups,dc=est,dc=pki,dc=example,dc=com
est_realm_statements=/usr/share/pki/est/conf/realm/postgresql/statements.conf
est_authorizer_exec_path=/usr/share/pki/est/bin/estauthz