diff options
| author | Aldo Cortesi <aldo@nullcube.com> | 2011-02-20 12:12:55 +1300 |
|---|---|---|
| committer | Aldo Cortesi <aldo@nullcube.com> | 2011-02-20 12:17:10 +1300 |
| commit | 4fc807cedd9a481db9e0fc1633d8c169f53f4a8e (patch) | |
| tree | fdb9ebc487e50d7546e8eb8b50e29223458b9ec4 /libmproxy/resources/cert.cnf | |
| parent | d7ace1ce9ef3832fc766c25067f8cd23fea62d8a (diff) | |
| download | mitmproxy-4fc807cedd9a481db9e0fc1633d8c169f53f4a8e.tar.gz mitmproxy-4fc807cedd9a481db9e0fc1633d8c169f53f4a8e.tar.bz2 mitmproxy-4fc807cedd9a481db9e0fc1633d8c169f53f4a8e.zip | |
Clean up certificate generation.
- Use templates for config files. We can re-introduce customization of the
certificate attributes when we need them.
- Split CA and cert generation into separate functions.
- Generation methods provide an error return when generation fails.
- When the user explicitly specifies a certificate, we don't generate it, but
fail if it doesn't exist.
Diffstat (limited to 'libmproxy/resources/cert.cnf')
| -rw-r--r-- | libmproxy/resources/cert.cnf | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/libmproxy/resources/cert.cnf b/libmproxy/resources/cert.cnf new file mode 100644 index 00000000..9afae09f --- /dev/null +++ b/libmproxy/resources/cert.cnf @@ -0,0 +1,34 @@ +[ req ] +prompt = no +distinguished_name = req_distinguished_name +x509_extensions = v3_cert +req_extensions = v3_cert_req + +[ req_distinguished_name ] +organizationName = mitmproxy +commonName = %(commonname)s + +[ v3_ca ] +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid:always,issuer +basicConstraints = critical,CA:true +keyUsage = cRLSign, keyCertSign +nsCertType = sslCA + +[ v3_ca_req ] +basicConstraints = critical,CA:true +keyUsage = cRLSign, keyCertSign +nsCertType = sslCA + +[ v3_cert ] +basicConstraints = CA:false +keyUsage = nonRepudiation, digitalSignature, keyEncipherment +nsCertType = server +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid:always,issuer + +[ v3_cert_req ] +basicConstraints = CA:false +keyUsage = nonRepudiation, digitalSignature, keyEncipherment +nsCertType = server + |