M7350v1_en_gpl

oe-core/meta-msm/recipes/lighttpd/files/index.html.lighttpd

@@ -0,0 +1 @@
+<html><body><h1>It works!</h1></body></html>

oe-core/meta-msm/recipes/lighttpd/files/lighttpd

@@ -0,0 +1,104 @@
+#!/bin/sh
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+DAEMON=/usr/sbin/lighttpd
+<<<<<<< HEAD
+=======
+WEBSERVER_FOLDER_PERM="chmod -R 770 /WEBSERVER"
+WEBSERVER_OWNER_PERM="chown -R www-data:www-data /WEBSERVER "
+WWW_FOLDER_PERM="chmod -R 770 /www "
+WWW_OWNER_PERM="chown -R www-data:www-data /www "
+RM_RESOURCE_FILES="rm -rf /www/session_token.txt /www/login_attempt /www/qcmap_session /www/qcmap_cgi_webclient_file "
+PRIVATE_KEY_PATH="/etc/mdm9625.com.key"
+NO_PSWD_PRIVATE_KEY_PATH="/etc/nopwd.mdm9625.com.key"
+CHNG_PERM_PRIVATE_KEY_PATH="chmod 755 /etc/mdm9625.com.key"
+SELF_SIGN_CA_PATH="/etc/mdm9625.com.crt"
+NO_PASWD_SELF_SIGN_CA_PATH="/etc/mdm9625.com.pem"
+CHNG_PERM_SELF_SIGN_CA_PATH="chmod 755 /etc/mdm9625.com.pem"
+OPEN_SSL_PATH="/etc/openssl.cnf"
+>>>>>>> 6bc1349... Lighttpd: auto generation of certificates.
+NAME=lighttpd
+DESC="Lighttpd Web Server"
+OPTS="-f /etc/lighttpd.conf"
+
+case "$1" in
+  start)
+	echo -n "Starting $DESC: "
+	$RM_RESOURCE_FILES
+	rm -rf $PRIVATE_KEY_PATH $NO_PSWD_PRIVATE_KEY_PATH 
+	echo -n "generating self-signing certificate for webserver: "
+	RANDOM_NO=`echo $RANDOM`
+	#generate a private key using openssl API command
+	echo -n "generating private key for webserver: "
+	openssl genrsa -des3 -out $PRIVATE_KEY_PATH -passout pass:$RANDOM_NO 1024
+	#generate a self-signed CA certificate using openssl API command
+	echo -n "generating self-signed CA for webserver: "
+	$CHNG_PERM_PRIVATE_KEY_PATH
+	openssl req -new -config $OPEN_SSL_PATH -x509 -key $PRIVATE_KEY_PATH -passin pass:$RANDOM_NO -out $SELF_SIGN_CA_PATH -days 1095
+	echo -n "generating no password for private key webserver: "
+	openssl rsa -in $PRIVATE_KEY_PATH -out $NO_PSWD_PRIVATE_KEY_PATH -passin pass:$RANDOM_NO
+	echo -n "generating no password for self-sign CA for webserver: "
+	cat $NO_PSWD_PRIVATE_KEY_PATH $SELF_SIGN_CA_PATH > $NO_PASWD_SELF_SIGN_CA_PATH
+    rm -rf $SELF_SIGN_CA_PATH
+	rm -rf $PRIVATE_KEY_PATH
+	mv $NO_PSWD_PRIVATE_KEY_PATH $PRIVATE_KEY_PATH
+	$CHNG_PERM_PRIVATE_KEY_PATH
+	$CHNG_PERM_SELF_SIGN_CA_PATH
+	echo -n "changing permissions for WEBSERVER: "
+	$WEBSERVER_FOLDER_PERM
+	$WEBSERVER_OWNER_PERM
+	echo -n "changing permissions for www: "
+	$WWW_FOLDER_PERM
+	$WWW_OWNER_PERM
+	start-stop-daemon --start -x "$DAEMON" -- $OPTS
+	echo "$NAME."
+	;;
+  stop)
+	echo -n "Stopping $DESC: "
+	start-stop-daemon --stop -x "$DAEMON"
+	echo "$NAME."
+	;;
+  restart|force-reload)
+	echo -n "Restarting $DESC: "
+<<<<<<< HEAD
+=======
+	$RM_RESOURCE_FILES
+	rm -rf $PRIVATE_KEY_PATH $NO_PSWD_PRIVATE_KEY_PATH 
+	echo -n "generating self-signing certificate for webserver: "
+	RANDOM_NO=`echo $RANDOM`
+	#generate a private key using openssl API command
+	echo -n "generating private key for webserver: "
+	openssl genrsa -des3 -out $PRIVATE_KEY_PATH -passout pass:$RANDOM_NO 1024
+	#generate a self-signed CA certificate using openssl API command
+	echo -n "generating self-signed CA for webserver: "
+	$CHNG_PERM_PRIVATE_KEY_PATH
+	openssl req -new -config $OPEN_SSL_PATH -x509 -key $PRIVATE_KEY_PATH -passin pass:$RANDOM_NO -out $SELF_SIGN_CA_PATH -days 1095
+	echo -n "generating no password for private key webserver: "
+	openssl rsa -in $PRIVATE_KEY_PATH -out $NO_PSWD_PRIVATE_KEY_PATH -passin pass:$RANDOM_NO
+	echo -n "generating no password for self-sign CA for webserver: "
+	cat $NO_PSWD_PRIVATE_KEY_PATH $SELF_SIGN_CA_PATH > $NO_PASWD_SELF_SIGN_CA_PATH
+    rm -rf $SELF_SIGN_CA_PATH
+	rm -rf $PRIVATE_KEY_PATH
+	mv $NO_PSWD_PRIVATE_KEY_PATH $PRIVATE_KEY_PATH
+	$CHNG_PERM_PRIVATE_KEY_PATH
+	$CHNG_PERM_SELF_SIGN_CA_PATH
+	echo -n "changing permissions for WEBSERVER: "
+	$WEBSERVER_FOLDER_PERM
+	$WEBSERVER_OWNER_PERM
+	echo -n "changing permissions for www: "
+	$WWW_FOLDER_PERM
+	$WWW_OWNER_PERM
+>>>>>>> 6bc1349... Lighttpd: auto generation of certificates.
+	start-stop-daemon --stop -x "$DAEMON"
+	sleep 1
+	start-stop-daemon --start -x "$DAEMON" -- $OPTS
+	echo "$NAME."
+	;;
+  *)
+	N=/etc/init.d/$NAME
+	echo "Usage: $N {start|stop|restart|force-reload}" >&2
+	exit 1
+	;;
+esac
+
+exit 0

oe-core/meta-msm/recipes/lighttpd/files/lighttpd.conf

@@ -0,0 +1,366 @@
+# lighttpd configuration file
+#
+# use it as a base for lighttpd 1.0.0 and above
+#
+# $Id: lighttpd.conf,v 1.7 2004/11/03 22:26:05 weigon Exp $
+
+############ Options you really have to take care of ####################
+
+## modules to load
+# at least mod_access and mod_accesslog should be loaded
+# all other module should only be loaded if really neccesary
+# - saves some time
+# - saves memory
+server.modules              = (
+#                               "mod_rewrite",
+                               "mod_redirect",
+                                "mod_alias",
+                                "mod_access",
+#                               "mod_cml",
+#                               "mod_trigger_b4_dl",
+                                "mod_auth",
+#                               "mod_status",
+#                               "mod_setenv",
+#                               "mod_fastcgi",
+#                               "mod_proxy",
+#                               "mod_simple_vhost",
+#                               "mod_evhost",
+#                               "mod_userdir",
+                                "mod_cgi",
+                                "mod_compress",
+#                               "mod_ssi",
+#                               "mod_usertrack",
+#                               "mod_expire",
+#                               "mod_secdownload",
+#                               "mod_rrdtool",
+#                               "mod_webdav",
+                                "mod_accesslog" )
+
+## a static document-root, for virtual-hosting take look at the
+## server.virtual-* options
+#server.document-root        = "/var/www/"
+server.document-root         = "/WEBSERVER/www/"
+## where to send error-messages to
+#server.errorlog             = "/www/logs/lighttpd.error.log"
+
+# files to check for if .../ is requested
+index-file.names            = ( "QCMAP.html",
+                                "index.php", "index.html",
+                                "index.htm", "default.htm" )
+
+## set the event-handler (read the performance section in the manual)
+# server.event-handler = "freebsd-kqueue" # needed on OS X
+
+# mimetype mapping
+mimetype.assign             = (
+  ".pdf"          =>      "application/pdf",
+  ".sig"          =>      "application/pgp-signature",
+  ".spl"          =>      "application/futuresplash",
+  ".class"        =>      "application/octet-stream",
+  ".ps"           =>      "application/postscript",
+  ".torrent"      =>      "application/x-bittorrent",
+  ".dvi"          =>      "application/x-dvi",
+  ".gz"           =>      "application/x-gzip",
+  ".pac"          =>      "application/x-ns-proxy-autoconfig",
+  ".swf"          =>      "application/x-shockwave-flash",
+  ".tar.gz"       =>      "application/x-tgz",
+  ".tgz"          =>      "application/x-tgz",
+  ".tar"          =>      "application/x-tar",
+  ".zip"          =>      "application/zip",
+  ".mp3"          =>      "audio/mpeg",
+  ".m3u"          =>      "audio/x-mpegurl",
+  ".wma"          =>      "audio/x-ms-wma",
+  ".wax"          =>      "audio/x-ms-wax",
+  ".ogg"          =>      "application/ogg",
+  ".wav"          =>      "audio/x-wav",
+  ".gif"          =>      "image/gif",
+  ".jar"          =>      "application/x-java-archive",
+  ".jpg"          =>      "image/jpeg",
+  ".jpeg"         =>      "image/jpeg",
+  ".png"          =>      "image/png",
+  ".xbm"          =>      "image/x-xbitmap",
+  ".xpm"          =>      "image/x-xpixmap",
+  ".xwd"          =>      "image/x-xwindowdump",
+  ".css"          =>      "text/css",
+  ".html"         =>      "text/html",
+  ".htm"          =>      "text/html",
+  ".js"           =>      "text/javascript",
+  ".asc"          =>      "text/plain",
+  ".c"            =>      "text/plain",
+  ".cpp"          =>      "text/plain",
+  ".log"          =>      "text/plain",
+  ".conf"         =>      "text/plain",
+  ".text"         =>      "text/plain",
+  ".txt"          =>      "text/plain",
+  ".dtd"          =>      "text/xml",
+  ".xml"          =>      "text/xml",
+  ".mpeg"         =>      "video/mpeg",
+  ".mpg"          =>      "video/mpeg",
+  ".mov"          =>      "video/quicktime",
+  ".qt"           =>      "video/quicktime",
+  ".avi"          =>      "video/x-msvideo",
+  ".asf"          =>      "video/x-ms-asf",
+  ".asx"          =>      "video/x-ms-asf",
+  ".wmv"          =>      "video/x-ms-wmv",
+  ".bz2"          =>      "application/x-bzip",
+  ".tbz"          =>      "application/x-bzip-compressed-tar",
+  ".tar.bz2"      =>      "application/x-bzip-compressed-tar"
+ )
+
+# Use the "Content-Type" extended attribute to obtain mime type if possible
+#mimetype.use-xattr        = "enable"
+
+## send a different Server: header
+## be nice and keep it at lighttpd
+# server.tag                 = "lighttpd"
+
+#### accesslog module
+accesslog.filename          = "/www/logs/access.log"
+debug.log-request-handling = "enable"
+
+$HTTP["url"] =~ "/" {
+                server.document-root        = "/WEBSERVER/www/"
+                server.errorlog             = "/www/logs/lighttpd.error.log"
+                server.port                 = 80
+                server.max-connections      = 1
+                accesslog.filename          = "/www/logs/access.log"
+                auth.debug                  = 2
+                auth.backend                = "plain"
+                auth.backend.plain.userfile = "/etc/lighttpd.user"
+                     }
+
+
+## deny access the file-extensions
+#
+# ~    is for backupfiles from vi, emacs, joe, ...
+# .inc is often used for code includes which should in general not be part
+#      of the document-root
+url.access-deny             = ( "~", ".inc" )
+$HTTP["url"] =~ "/cgi-bin/" {
+   cgi.assign = ( "" => "" )
+}
+$HTTP["url"] =~ "\.pdf$" {
+  server.range-requests = "disable"
+}
+
+##
+# which extensions should not be handle via static-file transfer
+#
+# .php, .pl, .fcgi are most often handled by mod_fastcgi or mod_cgi
+static-file.exclude-extensions = ( ".php", ".pl", ".fcgi" )
+
+######### Options that are good to be but not neccesary to be changed #######
+
+## bind to port (default: 80)
+#server.port                = 81
+
+## bind to localhost (default: all interfaces)
+#server.bind                = "mdm9625"
+
+## error-handler for status 404
+#server.error-handler-404   = "/error-handler.html"
+#server.error-handler-404   = "/error-handler.php"
+
+## to help the rc.scripts
+#server.pid-file            = "/var/run/lighttpd.pid"
+
+
+###### virtual hosts
+##
+##  If you want name-based virtual hosting add the next three settings and load
+##  mod_simple_vhost
+##
+## document-root =
+##   virtual-server-root + virtual-server-default-host + virtual-server-docroot
+## or
+##   virtual-server-root + http-host + virtual-server-docroot
+##
+#simple-vhost.server-root   = "/home/weigon/wwwroot/servers/"
+#simple-vhost.default-host  = "grisu.home.kneschke.de"
+#simple-vhost.document-root = "/pages/"
+
+
+##
+## Format: <errorfile-prefix><status-code>.html
+## -> ..../status-404.html for 'File not found'
+#server.errorfile-prefix    = "/home/weigon/projects/lighttpd/doc/status-"
+
+## virtual directory listings
+#dir-listing.activate       = "enable"
+
+## enable debugging
+#debug.log-request-header   = "enable"
+#debug.log-response-header  = "enable"
+#debug.log-request-handling = "enable"
+#debug.log-file-not-found   = "enable"
+
+### only root can use these options
+#
+# chroot() to directory (default: no chroot() )
+server.chroot              = "/"
+
+## change uid to <uid> (default: don't care)
+#server.username            = "wwwrun"
+
+## change uid to <uid> (default: don't care)
+#server.groupname           = "wwwrun"
+
+#### compress module
+#compress.cache-dir         = "/tmp/lighttpd/cache/compress/"
+#compress.filetype          = ("text/plain", "text/html")
+
+#### proxy module
+## read proxy.txt for more info
+#proxy.server               = ( ".php" =>
+#                               ( "localhost" =>
+#                                 (
+#                                   "host" => "192.168.0.101",
+#                                   "port" => 80
+#                                 )
+#                               )
+#                             )
+
+#### fastcgi module
+## read fastcgi.txt for more info
+## for PHP don't forget to set cgi.fix_pathinfo = 1 in the php.ini
+#fastcgi.server             = ( ".php" =>
+#                               ( "localhost" =>
+#                                 (
+#                                   "socket" => "/tmp/php-fastcgi.socket",
+#                                   "bin-path" => "/usr/local/bin/php"
+#                                 )
+#                               )
+#                            )
+
+#### CGI module
+#cgi.assign                 = ( ".pl"  => "/usr/bin/perl",
+#                               ".cgi" => "/usr/bin/perl" )
+#
+$HTTP["scheme"] == "http" {
+    # capture vhost name with regex conditiona -> %0 in redirect pattern
+    # must be the most inner block to the redirect rule
+    $HTTP["host"] =~ ".*" {
+        url.redirect = (".*" => "https://%0$0")
+    }
+}
+#$SERVER["socket"] == ":80" {
+#  $HTTP["host"] =~ ".*" {
+#         url.redirect = (".*" => "https://%0$0")
+#         url.redirect = ( "^/(.*)" => "https://mdm9625.com/$1" )
+#         server.name                 = "mdm9625.com"
+#  }
+#}
+$SERVER["socket"] == ":443" {
+ ssl.engine = "enable"
+ ssl.pemfile = "/etc/mdm9625.com.pem"
+# ssl.ca-file = "/etc/mdm9625.com.crt"
+ server.name = "mdm9625.com"
+ server.document-root = "/WEBSERVER/www/"
+ server.errorlog = "/www/logs/serror.log"
+ server.max-connections      = 1
+ accesslog.filename = "/www/logs/saccess.log"
+                auth.debug                  = 2
+                auth.backend                = "plain"
+                auth.backend.plain.userfile = "/etc/lighttpd.user"
+}
+#### SSL engine
+#ssl.engine                 = "enable"
+#ssl.pemfile                = "server.pem"
+
+#### status module
+#status.status-url          = "/server-status"
+#status.config-url          = "/server-config"
+
+#### auth module
+## read authentication.txt for more info
+#auth.backend               = "plain"
+#auth.backend.plain.userfile = "lighttpd.user"
+#auth.backend.plain.groupfile = "lighttpd.group"
+
+#auth.backend.ldap.hostname = "localhost"
+#auth.backend.ldap.base-dn  = "dc=my-domain,dc=com"
+#auth.backend.ldap.filter   = "(uid=$)"
+
+#auth.require               = ( "/server-status" =>
+#                               (
+#                                 "method"  => "digest",
+#                                 "realm"   => "download archiv",
+#                                 "require" => "user=jan"
+#                               ),
+#                               "/server-config" =>
+#                               (
+#                                 "method"  => "digest",
+#                                 "realm"   => "download archiv",
+#                                 "require" => "valid-user"
+#                               )
+#                             )
+
+#### url handling modules (rewrite, redirect, access)
+#url.rewrite                = ( "^/$"             => "/server-status" )
+#url.redirect               = ( "^/wishlist/(.+)" => "http://www.123.org/$1" )
+
+#### both rewrite/redirect support back reference to regex conditional using %n
+#$HTTP["host"] =~ "^www\.(.*)" {
+#  url.redirect            = ( "^/(.*)" => "http://%1/$1" )
+#}
+
+#
+# define a pattern for the host url finding
+# %% => % sign
+# %0 => domain name + tld
+# %1 => tld
+# %2 => domain name without tld
+# %3 => subdomain 1 name
+# %4 => subdomain 2 name
+#
+#evhost.path-pattern        = "/home/storage/dev/www/%3/htdocs/"
+
+#### expire module
+#expire.url                 = ( "/buggy/" => "access 2 hours", "/asdhas/" => "access plus 1 seconds 2 minutes")
+
+#### ssi
+#ssi.extension              = ( ".shtml" )
+
+#### rrdtool
+#rrdtool.binary             = "/usr/bin/rrdtool"
+#rrdtool.db-name            = "/var/www/lighttpd.rrd"
+
+#### setenv
+#setenv.add-request-header  = ( "TRAV_ENV" => "mysql://user@host/db" )
+#setenv.add-response-header = ( "X-Secret-Message" => "42" )
+
+## for mod_trigger_b4_dl
+# trigger-before-download.gdbm-filename = "/home/weigon/testbase/trigger.db"
+# trigger-before-download.memcache-hosts = ( "127.0.0.1:11211" )
+# trigger-before-download.trigger-url = "^/trigger/"
+# trigger-before-download.download-url = "^/download/"
+# trigger-before-download.deny-url = "http://127.0.0.1/index.html"
+# trigger-before-download.trigger-timeout = 10
+
+## for mod_cml
+## don't forget to add index.cml to server.indexfiles
+# cml.extension               = ".cml"
+# cml.memcache-hosts          = ( "127.0.0.1:11211" )
+
+#### variable usage:
+## variable name without "." is auto prefixed by "var." and becomes "var.bar"
+#bar = 1
+#var.mystring = "foo"
+
+## integer add
+#bar += 1
+## string concat, with integer cast as string, result: "www.foo1.com"
+#server.name = "www." + mystring + var.bar + ".com"
+## array merge
+#index-file.names = (foo + ".php") + index-file.names
+#index-file.names += (foo + ".php")
+
+#### include
+#include /etc/lighttpd/lighttpd-inc.conf
+## same as above if you run: "lighttpd -f /etc/lighttpd/lighttpd.conf"
+#include "lighttpd-inc.conf"
+
+#### include_shell
+#include_shell "echo var.a=1"
+## the above is same as:
+#var.a=1

oe-core/meta-msm/recipes/lighttpd/files/lighttpd.user

@@ -0,0 +1 @@
+admin:admin

oe-core/meta-msm/recipes/lighttpd/files/openssl.cnf

@@ -0,0 +1,324 @@
+#
+# OpenSSL example configuration file.
+# This is mostly being used for generation of certificate requests.
+#
+
+# This definition stops the following lines choking if HOME isn't
+# defined.
+HOME			= .
+RANDFILE		= $ENV::HOME/.rnd
+
+# Extra OBJECT IDENTIFIER info:
+#oid_file		= $ENV::HOME/.oid
+oid_section		= new_oids
+
+# To use this configuration file with the "-extfile" option of the
+# "openssl x509" utility, name here the section containing the
+# X.509v3 extensions to use:
+# extensions		=
+# (Alternatively, use a configuration file that has only
+# X.509v3 extensions in its main [= default] section.)
+
+[ new_oids ]
+
+# We can add new OIDs in here for use by 'ca' and 'req'.
+# Add a simple OID like this:
+# testoid1=1.2.3.4
+# Or use config file substitution like this:
+# testoid2=${testoid1}.5.6
+
+####################################################################
+[ ca ]
+default_ca	= CA_default		# The default ca section
+
+####################################################################
+[ CA_default ]
+
+dir		= ./demoCA		# Where everything is kept
+certs		= $dir/certs		# Where the issued certs are kept
+crl_dir		= $dir/crl		# Where the issued crl are kept
+database	= $dir/index.txt	# database index file.
+#unique_subject	= no			# Set to 'no' to allow creation of
+					# several ctificates with same subject.
+new_certs_dir	= $dir/newcerts		# default place for new certs.
+
+certificate	= $dir/cacert.pem 	# The CA certificate
+serial		= $dir/serial 		# The current serial number
+crlnumber	= $dir/crlnumber	# the current crl number
+					# must be commented out to leave a V1 CRL
+crl		= $dir/crl.pem 		# The current CRL
+private_key	= $dir/private/cakey.pem# The private key
+RANDFILE	= $dir/private/.rand	# private random number file
+
+x509_extensions	= usr_cert		# The extentions to add to the cert
+
+# Comment out the following two lines for the "traditional"
+# (and highly broken) format.
+name_opt 	= ca_default		# Subject Name options
+cert_opt 	= ca_default		# Certificate field options
+
+# Extension copying option: use with caution.
+# copy_extensions = copy
+
+# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
+# so this is commented out by default to leave a V1 CRL.
+# crlnumber must also be commented out to leave a V1 CRL.
+# crl_extensions	= crl_ext
+
+default_days	= 365			# how long to certify for
+default_crl_days= 30			# how long before next CRL
+default_md	= sha1			# which md to use.
+preserve	= no			# keep passed DN ordering
+
+# A few difference way of specifying how similar the request should look
+# For type CA, the listed attributes must be the same, and the optional
+# and supplied fields are just that :-)
+policy		= policy_match
+
+# For the CA policy
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= match
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+# For the 'anything' policy
+# At this point in time, you must list all acceptable 'object'
+# types.
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+####################################################################
+[ req ]
+default_bits		= 1024
+default_keyfile 	= privkey.pem
+distinguished_name	= req_distinguished_name
+attributes		= req_attributes
+prompt       		= no
+x509_extensions	= v3_ca	# The extentions to add to the self signed cert
+
+# Passwords for private keys if not present they will be prompted for
+# input_password = secret
+# output_password = secret
+
+# This sets a mask for permitted string types. There are several options.
+# default: PrintableString, T61String, BMPString.
+# pkix   : PrintableString, BMPString.
+# utf8only: only UTF8Strings.
+# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
+# MASK:XXXX a literal mask value.
+# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
+# so use this option with caution!
+string_mask = nombstr
+
+# req_extensions = v3_req # The extensions to add to a certificate request
+
+[ req_distinguished_name ]
+C                      = US
+ST                     = Middle Earth
+L                      = Mordor
+O                      = The One Ring Ltd
+OU                     = YourID
+CN                     = webserver
+emailAddress           = yourid@yoursite.com
+#countryName           = "prompt"
+#countryName_default   = US
+#countryName_min       = 2
+#countryName_max       = 2
+#
+#stateOrProvinceName		= State or Province Name (full name)
+#stateOrProvinceName_default	= Middle Earth
+#
+#localityName			= Locality Name (eg, city)
+#localityName_default		= Mordor
+#
+#0.organizationName		= Organization Name (eg, company)
+#0.organizationName_default	= The One Ring Ltd
+
+# we can do this but it is not needed normally :-)
+#1.organizationName		= Second Organization Name (eg, company)
+#1.organizationName_default	= World Wide Web Pty Ltd
+
+#organizationalUnitName		= Organizational Unit Name (eg, section)
+#organizationalUnitName_default	=MobileAP
+
+#commonName			= Common Name (eg, YOUR name)
+#commonName_default		= webserver
+#commonName_max			= 64
+
+#emailAddress			= Email Address
+#emailAddress_default		= yourid@yoursite.com
+#emailAddress_max		= 64
+
+# SET-ex3			= SET extension number 3
+
+[ req_attributes ]
+challengePassword		= A challenge password
+challengePassword_min		= 4
+challengePassword_max		= 20
+
+unstructuredName		= An optional company name
+
+[ usr_cert ]
+
+# These extensions are added when 'ca' signs a request.
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+
+# This is OK for an SSL server.
+# nsCertType			= server
+
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+
+# For normal client use this is typical
+# nsCertType = client, email
+
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# This will be displayed in Netscape's comment listbox.
+nsComment			= "OpenSSL Generated Certificate"
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+# An alternative to produce certificates that aren't
+# deprecated according to PKIX.
+# subjectAltName=email:move
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+
+[ v3_req ]
+
+# Extensions to add to a certificate request
+
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+[ v3_ca ]
+
+
+# Extensions for a typical CA
+
+
+# PKIX recommendation.
+
+subjectKeyIdentifier=hash
+
+authorityKeyIdentifier=keyid:always,issuer:always
+
+# This is what PKIX recommends but some broken software chokes on critical
+# extensions.
+#basicConstraints = critical,CA:true
+# So we do this instead.
+basicConstraints = CA:true
+
+# Key usage: this is typical for a CA certificate. However since it will
+# prevent it being used as an test self-signed certificate it is best
+# left out by default.
+# keyUsage = cRLSign, keyCertSign
+
+# Some might want this also
+# nsCertType = sslCA, emailCA
+
+# Include email address in subject alt name: another PKIX recommendation
+# subjectAltName=email:copy
+# Copy issuer details
+# issuerAltName=issuer:copy
+
+# DER hex encoding of an extension: beware experts only!
+# obj=DER:02:03
+# Where 'obj' is a standard or added object
+# You can even override a supported extension:
+# basicConstraints= critical, DER:30:03:01:01:FF
+
+[ crl_ext ]
+
+# CRL extensions.
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
+
+# issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always,issuer:always
+
+[ proxy_cert_ext ]
+# These extensions should be added when creating a proxy certificate
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+
+# This is OK for an SSL server.
+# nsCertType			= server
+
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+
+# For normal client use this is typical
+# nsCertType = client, email
+
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# This will be displayed in Netscape's comment listbox.
+nsComment			= "OpenSSL Generated Certificate"
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+# An alternative to produce certificates that aren't
+# deprecated according to PKIX.
+# subjectAltName=email:move
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+
+# This really needs to be in place for it to be a proxy certificate.
+proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo