summaryrefslogtreecommitdiffstats
path: root/base/deploy/config/deployment.cfg
blob: 6ff7a35bbb1e7968680bc34408b7bbb839eed52d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
###############################################################################
##  Default Configuration:                                                   ##
##                                                                           ##
##  This section contains meta-parameters that determine how the PKI         ##
##  configuration should work.                                               ##
###############################################################################
[DEFAULT]

# The sensitive_parameters contains a list of parameters which may contain
# sensitive information which must not be displayed to the console nor stored
# in log files for security reasons.
sensitive_parameters=
    pki_admin_password
    pki_backup_password
    pki_client_database_password
    pki_client_pin
    pki_client_pkcs12_password
    pki_clone_pkcs12_password
    pki_ds_password
    pki_one_time_pin
    pki_pin
    pki_security_domain_password
    pki_token_password

# The spawn_scriplets contains a list of scriplets to be executed by pkispawn.
spawn_scriplets=
    initialization
    infrastructure_layout
    instance_layout
    subsystem_layout
    selinux_setup
    webapp_deployment
    slot_substitution
    security_databases
    configuration
    finalization

# The destroy_scriplets contains a list of scriplets to be executed by pkidestroy.
destroy_scriplets=
    initialization
    configuration
    webapp_deployment
    subsystem_layout
    security_databases
    instance_layout
    selinux_setup
    infrastructure_layout
    finalization

###############################################################################
##  Common Configuration:                                                    ##
##                                                                           ##
##  Values in this section are common to more than one PKI subsystem, and    ##
##  contain required information which MAY be overridden by users as         ##
##  necessary.                                                               ##
##                                                                           ##
##  NOTE:  Default values will be generated for any and all required         ##
##         'common' data values which are left undefined.                    ##
###############################################################################
[Common]
pki_admin_cert_request_type=crmf
pki_admin_domain_name=
pki_admin_dualkey=False
pki_admin_email=
pki_admin_keysize=2048
pki_admin_name=
pki_admin_nickname=
pki_admin_password=
pki_admin_subject_dn=
pki_admin_uid=
pki_audit_group=pkiaudit
pki_audit_signing_key_algorithm=SHA256withRSA
pki_audit_signing_key_size=2048
pki_audit_signing_key_type=rsa
pki_audit_signing_nickname=
pki_audit_signing_signing_algorithm=SHA256withRSA
pki_audit_signing_subject_dn=
pki_audit_signing_token=
pki_backup_keys=False
pki_backup_password=
pki_client_database_dir=
pki_client_database_password=
pki_client_database_purge=True
pki_client_dir=
pki_client_pkcs12_password=
pki_ds_base_dn=
pki_ds_bind_dn=cn=Directory Manager
pki_ds_database=
pki_ds_hostname=
pki_ds_ldap_port=389
pki_ds_ldaps_port=636
pki_ds_password=
pki_ds_remove_data=True
pki_ds_secure_connection=False
pki_group=pkiuser
pki_issuing_ca=
pki_restart_configured_instance=True
pki_security_domain_hostname=
pki_security_domain_https_port=8443
pki_security_domain_name=
pki_security_domain_password=
pki_security_domain_user=
pki_skip_configuration=False
pki_skip_installation=False
pki_ssl_server_key_algorithm=SHA256withRSA
pki_ssl_server_key_size=2048
pki_ssl_server_key_type=rsa
pki_ssl_server_nickname=
pki_ssl_server_subject_dn=
pki_ssl_server_token=
pki_subsystem_key_algorithm=SHA256withRSA
pki_subsystem_key_size=2048
pki_subsystem_key_type=rsa
pki_subsystem_nickname=
pki_subsystem_subject_dn=
pki_subsystem_token=
pki_token_name=internal
pki_token_password=
pki_user=pkiuser

###############################################################################
##  Apache Configuration:                                                    ##
##                                                                           ##
##  Values in this section are common to PKI subsystems that run             ##
##  as an instance of 'Apache' (RA and TPS subsystems), and contain          ##
##  required information which MAY be overridden by users as necessary.      ##
###############################################################################
[Apache]
pki_instance_name=pki-apache
pki_http_port=80
pki_https_port=443

###############################################################################
##  Tomcat Configuration:                                                    ##
##                                                                           ##
##  Values in this section are common to PKI subsystems that run             ##
##  as an instance of 'Tomcat' (CA, KRA, OCSP, and TKS subsystems            ##
##  including 'Clones', 'Subordinate CAs', and 'External CAs'), and contain  ##
##  required information which MAY be overridden by users as necessary.      ##
##                                                                           ##
##  PKI CLONES:  To specify a 'CA Clone', a 'KRA Clone', an 'OCSP Clone',    ##
##               or a 'TKS Clone', change the value of 'pki_clone'           ##
##               from 'False' to 'True'.                                     ##
##                                                                           ##
##    REMINDER:  PKI CA Clones, Subordinate CAs, and External CAs            ##
##               are MUTUALLY EXCLUSIVE entities!!!                          ##
###############################################################################
[Tomcat]
pki_ajp_port=8009
pki_clone=False
pki_clone_pkcs12_password=
pki_clone_pkcs12_path=
pki_clone_replicate_schema=True
pki_clone_replication_master_port=
pki_clone_replication_clone_port=
pki_clone_replication_security=None
pki_clone_uri=
pki_enable_java_debugger=False
pki_enable_proxy=False
pki_http_port=8080
pki_https_port=8443
pki_instance_name=pki-tomcat
pki_proxy_http_port=80
pki_proxy_https_port=443
pki_security_manager=true
pki_tomcat_server_port=8005

###############################################################################
##  CA Configuration:                                                        ##
##                                                                           ##
##  Values in this section are common to CA subsystems including 'PKI CAs',  ##
##  'Cloned CAs', 'Subordinate CAs', and 'External CAs', and contain         ##
##  required information which MAY be overridden by users as necessary.      ##
##                                                                           ##
##     EXTERNAL CAs:  To specify an 'External CA', change the value          ##
##                    of 'pki_external' from 'False' to 'True'.              ##
##                                                                           ##
##  SUBORDINATE CAs:  To specify a 'Subordinate CA', change the value        ##
##                    of 'pki_subordinate' from 'False' to 'True'.           ##
##                                                                           ##
##         REMINDER:  PKI CA Clones, Subordinate CAs, and External CAs       ##
##                    are MUTUALLY EXCLUSIVE entities!!!                     ##
###############################################################################
[CA]
pki_ca_signing_key_algorithm=SHA256withRSA
pki_ca_signing_key_size=2048
pki_ca_signing_key_type=rsa
pki_ca_signing_nickname=
pki_ca_signing_signing_algorithm=SHA256withRSA
pki_ca_signing_subject_dn=
pki_ca_signing_token=
pki_external=False
pki_external_ca_cert_chain_path=
pki_external_ca_cert_path=
pki_external_csr_path=
pki_external_step_two=False
pki_import_admin_cert=False
pki_ocsp_signing_key_algorithm=SHA256withRSA
pki_ocsp_signing_key_size=2048
pki_ocsp_signing_key_type=rsa
pki_ocsp_signing_nickname=
pki_ocsp_signing_signing_algorithm=SHA256withRSA
pki_ocsp_signing_subject_dn=
pki_ocsp_signing_token=
pki_subordinate=False
pki_subsystem=CA
pki_subsystem_name=

###############################################################################
##  KRA Configuration:                                                       ##
##                                                                           ##
##  Values in this section are common to KRA subsystems                      ##
##  including 'PKI KRAs' and 'Cloned KRAs', and contain                      ##
##  required information which MAY be overridden by users as necessary.      ##
###############################################################################
[KRA]
pki_import_admin_cert=True
pki_storage_key_algorithm=SHA256withRSA
pki_storage_key_size=2048
pki_storage_key_type=rsa
pki_storage_nickname=
pki_storage_signing_algorithm=SHA256withRSA
pki_storage_subject_dn=
pki_storage_token=
pki_subsystem=KRA
pki_subsystem_name=
pki_transport_key_algorithm=SHA256withRSA
pki_transport_key_size=2048
pki_transport_key_type=rsa
pki_transport_nickname=
pki_transport_signing_algorithm=SHA256withRSA
pki_transport_subject_dn=
pki_transport_token=

###############################################################################
##  OCSP Configuration:                                                      ##
##                                                                           ##
##  Values in this section are common to OCSP subsystems                     ##
##  including 'PKI OCSPs' and 'Cloned OCSPs', and contain                    ##
##  required information which MAY be overridden by users as necessary.      ##
###############################################################################
[OCSP]
pki_import_admin_cert=True
pki_ocsp_signing_key_algorithm=SHA256withRSA
pki_ocsp_signing_key_size=2048
pki_ocsp_signing_key_type=rsa
pki_ocsp_signing_nickname=
pki_ocsp_signing_signing_algorithm=SHA256withRSA
pki_ocsp_signing_subject_dn=
pki_ocsp_signing_token=
pki_subsystem=OCSP
pki_subsystem_name=

###############################################################################
##  RA Configuration:                                                        ##
##                                                                           ##
##  Values in this section are common to PKI RA subsystems, and contain      ##
##  required information which MAY be overridden by users as necessary.      ##
###############################################################################
[RA]
pki_subsystem=RA
pki_subsystem_name=

###############################################################################
##  TKS Configuration:                                                       ##
##                                                                           ##
##  Values in this section are common to TKS subsystems                      ##
##  including 'PKI TKSs' and 'Cloned TKSs', and contain                      ##
##  required information which MAY be overridden by users as necessary.      ##
###############################################################################
[TKS]
pki_import_admin_cert=True
pki_subsystem=TKS
pki_subsystem_name=

###############################################################################
##  TPS Configuration:                                                       ##
##                                                                           ##
##  Values in this section are common to PKI TPS subsystems, and contain     ##
##  required information which MAY be overridden by users as necessary.      ##
###############################################################################
[TPS]
pki_subsystem=TPS
pki_subsystem_name=