summaryrefslogtreecommitdiffstats
path: root/base/deploy/etc/default.cfg
blob: d99faf2c4c192a26943533eb488a27ef1fe13052 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
###############################################################################
##  Default Configuration:                                                   ##
##                                                                           ##
##  Values in this section are common to more than one PKI subsystem, and    ##
##  contain required information which MAY be overridden by users as         ##
##  necessary.                                                               ##
##                                                                           ##
##  There are also some meta-parameters that determine how the PKI           ##
##  configuratiion should work.                                              ##
##                                                                           ##
###############################################################################
[DEFAULT]

# The sensitive_parameters contains a list of parameters which may contain
# sensitive information which must not be displayed to the console nor stored
# in log files for security reasons.
sensitive_parameters=
    pki_admin_password
    pki_backup_password
    pki_client_database_password
    pki_client_pin
    pki_client_pkcs12_password
    pki_clone_pkcs12_password
    pki_ds_password
    pki_one_time_pin
    pki_pin
    pki_security_domain_password
    pki_token_password

# The spawn_scriplets contains a list of scriplets to be executed by pkispawn.
spawn_scriplets=
    initialization
    infrastructure_layout
    instance_layout
    subsystem_layout
    selinux_setup
    webapp_deployment
    slot_substitution
    security_databases
    configuration
    finalization

# The destroy_scriplets contains a list of scriplets to be executed by pkidestroy.
destroy_scriplets=
    initialization
    configuration
    webapp_deployment
    subsystem_layout
    security_databases
    instance_layout
    selinux_setup
    infrastructure_layout
    finalization

# By default, the following parameters will be set for Tomcat and Apache instances.
# There is no reason to uncomment these.  They are provided for reference in 
# case someone wants to override them in their config file.
#
# Tomcat instances:
# pki_instance_name=pki_tomcat 
# pki_https_port=8443
# pki_http_port=8080
#
# Apache instances:
# pki_instance_name=pki_tomcat
# pki_https_port=443
# pki_http_port=80

pki_admin_cert_file=%(pki_client_dir)s/ca_admin.cert
pki_admin_cert_request_type=crmf
pki_admin_dualkey=False
pki_admin_keysize=2048
pki_admin_password=
pki_audit_group=pkiaudit
pki_audit_signing_key_algorithm=SHA256withRSA
pki_audit_signing_key_size=2048
pki_audit_signing_key_type=rsa
pki_audit_signing_signing_algorithm=SHA256withRSA
pki_audit_signing_token=Internal Key Storage Token
pki_backup_keys=False
pki_backup_password=
pki_client_admin_cert_p12=%(pki_client_dir)s/%(pki_subsystem_type)s_admin_cert.p12
pki_client_database_password=
pki_client_database_purge=True
pki_client_dir=%(home_dir)s/.pki/%(pki_instance_name)s
pki_client_pkcs12_password=
pki_ds_bind_dn=cn=Directory Manager
pki_ds_ldap_port=389
pki_ds_ldaps_port=636
pki_ds_password=
pki_ds_remove_data=True
pki_ds_secure_connection=False
pki_group=pkiuser
pki_issuing_ca=
pki_restart_configured_instance=True
pki_security_domain_hostname=%(pki_hostname)s
pki_security_domain_https_port=8443
pki_security_domain_name=%(pki_dns_domainname)s Security Domain
pki_security_domain_password=
pki_security_domain_user=
pki_skip_configuration=False
pki_skip_installation=False
pki_ssl_server_key_algorithm=SHA256withRSA
pki_ssl_server_key_size=2048
pki_ssl_server_key_type=rsa
pki_ssl_server_nickname=Server-Cert cert-%(pki_instance_name)s
pki_ssl_server_subject_dn=cn=%(pki_hostname)s,o=%(pki_security_domain_name)s
pki_ssl_server_token=Internal Key Storage Token
pki_subsystem_key_algorithm=SHA256withRSA
pki_subsystem_key_size=2048
pki_subsystem_key_type=rsa
pki_subsystem_token=Internal Key Storage Token
pki_token_name=internal
pki_token_password=
pki_user=pkiuser

# Paths:
# These are used in the processing of pkispawn and are not supposed
# to be overwritten by user configuration files.
#
pki_client_database_dir=%(pki_client_subsystem_dir)s/alias
pki_client_subsystem_dir=%(pki_client_dir)s/%(pki_subsystem_type)s
pki_client_password_conf=%(pki_client_subsystem_dir)s/password.conf
pki_client_pkcs12_password_conf=%(pki_client_subsystem_dir)s/pkcs12_password.conf
pki_client_cert_database=%(pki_client_database_dir)s/cert8.db
pki_client_key_database=%(pki_client_database_dir)s/key3.db
pki_client_secmod_database=%(pki_client_database_dir)s/secmod.db
pki_client_admin_cert=%(pki_subsystem_type)s_admin.cert
pki_source_conf_path=/usr/share/pki/%(pki_subsystem_type)s/conf
pki_source_setup_path=/usr/share/pki/setup
pki_source_server_path=/usr/share/pki/server/conf
pki_source_cs_cfg=/usr/share/pki/%(pki_subsystem_type)s/conf/CS.cfg
pki_source_registry=/usr/share/pki/setup/pkidaemon_registry
pki_path=%(pki_root_prefix)s/var/lib/pki
pki_log_path=%(pki_root_prefix)s/var/log/pki
pki_configuration_path=%(pki_root_prefix)s/etc/pki
pki_registry_path=%(pki_root_prefix)s/etc/sysconfig/pki
pki_instance_path=%(pki_path)s/%(pki_instance_name)s
pki_instance_log_path=%(pki_log_path)s/%(pki_instance_name)s
pki_instance_configuration_path=%(pki_configuration_path)s/%(pki_instance_name)s
pki_database_path=%(pki_instance_configuration_path)s/alias
pki_instance_database_link=%(pki_instance_path)s/alias
pki_instance_conf_link=%(pki_instance_path)s/conf
pki_instance_logs_link=%(pki_instance_path)s/logs
pki_subsystem_path=%(pki_instance_path)s/%(pki_subsystem_type)s
pki_subsystem_log_path=%(pki_instance_log_path)s/%(pki_subsystem_type)s
pki_subsystem_archive_log_path=%(pki_subsystem_log_path)s/archive
pki_subsystem_configuration_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s
pki_subsystem_database_link=%(pki_subsystem_path)s/alias
pki_subsystem_conf_link=%(pki_subsystem_path)s/conf
pki_subsystem_logs_link=%(pki_subsystem_path)s/logs
pki_subsystem_registry_link=%(pki_subsystem_path)s/registry

 
###############################################################################
##  Apache Configuration:                                                    ##
##                                                                           ##
##  Values in this section are common to PKI subsystems that run             ##
##  as an instance of 'Apache' (RA and TPS subsystems), and contain          ##
##  required information which MAY be overridden by users as necessary.      ##
###############################################################################
[Apache]

# Paths
# These are used in the processing of pkispawn and are not supposed
# to be overwritten by user configuration files.
#
pki_systemd_service=/lib/systemd/system/pki-apached@.service
pki_systemd_target=/lib/systemd/system/pki-apached.target
pki_systemd_target_wants=/etc/systemd/system/pki-apached.target.wants
pki_systemd_service_link=%(pki_systemd_target_wants)s/pki-apached@%(pki_instance_name)s.service
pki_cgroup_systemd_service_path=/sys/fs/cgroup/systemd/system/%(pki_systemd_service)s
pki_cgroup_systemd_service=%(pki_cgroup_systemd_service_path)s/%(pki_instance_name)s
pki_cgroup_cpu_systemd_service_path=/sys/fs/cgroup/cpu\,cpuacct/system/%(pki_systemd_service)s
pki_cgroup_cpu_systemd_service=%(pki_cgroup_cpu_systemd_service_path)s/%(pki_systemd_service)s
pki_instance_type=Apache
pki_instance_type_registry_path =%(pki_registry_path)s/apache
pki_instance_registry_path=%(pki_instance_type_registry_path)s/%(pki_instance_name)s
pki_subsystem_registry_path=%(pki_instance_registry_path)s/%(pki_subsystem_type)s

###############################################################################
##  Tomcat Configuration:                                                    ##
##                                                                           ##
##  Values in this section are common to PKI subsystems that run             ##
##  as an instance of 'Tomcat' (CA, KRA, OCSP, and TKS subsystems            ##
##  including 'Clones', 'Subordinate CAs', and 'External CAs'), and contain  ##
##  required information which MAY be overridden by users as necessary.      ##
##                                                                           ##
##  PKI CLONES:  To specify a 'CA Clone', a 'KRA Clone', an 'OCSP Clone',    ##
##               or a 'TKS Clone', change the value of 'pki_clone'           ##
##               from 'False' to 'True'.                                     ##
##                                                                           ##
##    REMINDER:  PKI CA Clones, Subordinate CAs, and External CAs            ##
##               are MUTUALLY EXCLUSIVE entities!!!                          ##
###############################################################################
[Tomcat]
pki_ajp_port=8009
pki_clone=False
pki_clone_pkcs12_password=
pki_clone_pkcs12_path=
pki_clone_replicate_schema=True
pki_clone_replication_master_port=
pki_clone_replication_clone_port=
pki_clone_replication_security=None
pki_clone_uri=
pki_enable_java_debugger=False
pki_enable_proxy=False
pki_proxy_http_port=80
pki_proxy_https_port=443
pki_security_manager=true
pki_tomcat_server_port=8005

# Paths
# These are used in the processing of pkispawn and are not supposed
# to be overwritten by user configuration files.
#
pki_systemd_service=/lib/systemd/system/pki-tomcatd@.service
pki_systemd_target=/lib/systemd/system/pki-tomcatd.target
pki_systemd_target_wants=/etc/systemd/system/pki-tomcatd.target.wants
pki_systemd_service_link=%(pki_systemd_target_wants)s/pki-tomcatd@%(pki_instance_name)s.service
pki_cgroup_systemd_service_path=/sys/fs/cgroup/systemd/system/%(pki_systemd_service)s
pki_cgroup_systemd_service=%(pki_cgroup_systemd_service_path)s/%(pki_instance_name)s
pki_cgroup_cpu_systemd_service_path=/sys/fs/cgroup/cpu\,cpuacct/system/%(pki_systemd_service)s
pki_cgroup_cpu_systemd_service=%(pki_cgroup_cpu_systemd_service_path)s/%(pki_systemd_service)s
pki_tomcat_bin_path=/usr/share/tomcat/bin
pki_tomcat_lib_path=/usr/share/tomcat/lib
pki_tomcat_systemd=/usr/sbin/tomcat-sysd
pki_source_catalina_properties=%(pki_source_server_path)s/catalina.properties
pki_source_servercertnick_conf=%(pki_source_server_path)s/serverCertNick.conf
pki_source_server_xml=%(pki_source_server_path)s/server.xml
pki_source_context_xml=%(pki_source_server_path)s/context.xml
pki_source_tomcat_conf=%(pki_source_server_path)s/tomcat.conf
pki_instance_type=Tomcat
pki_tomcat_common_path=%(pki_instance_path)s/common
pki_tomcat_common_lib_path=%(pki_tomcat_common_path)s/lib
pki_tomcat_tmpdir_path=%(pki_instance_path)s/temp
pki_tomcat_webapps_path=%(pki_instance_path)s/webapps
pki_tomcat_webapps_root_path=%(pki_tomcat_webapps_path)s/ROOT
pki_tomcat_webapps_common_path=%(pki_tomcat_webapps_path)s/pki
pki_tomcat_webapps_root_webinf_path=%(pki_tomcat_webapps_root_path)s/WEB-INF
pki_tomcat_work_path=%(pki_instance_path)s/work
pki_tomcat_work_catalina_path=%(pki_tomcat_work_path)s/Catalina
pki_tomcat_work_catalina_host_path=%(pki_tomcat_work_catalina_path)s/localhost
pki_tomcat_work_catalina_host_run_path=%(pki_tomcat_work_catalina_host_path)s/_
pki_tomcat_work_catalina_host_subsystem_path=%(pki_tomcat_work_catalina_host_path)s/%(pki_subsystem_type)s
pki_instance_conf_log4j_properties=%(pki_instance_configuration_path)s/log4j.properties
pki_instance_type_registry_path=%(pki_registry_path)s/tomcat
pki_instance_registry_path=%(pki_instance_type_registry_path)s/%(pki_instance_name)s
pki_subsystem_registry_path=%(pki_instance_registry_path)s/%(pki_subsystem_type)s
pki_tomcat_bin_link=%(pki_instance_path)s/bin
pki_instance_lib=%(pki_instance_path)s/lib
pki_instance_lib_log4j_properties=%(pki_instance_lib)s/log4j.properties
pki_instance_systemd_link=%(pki_instance_path)s/%(pki_instance_name)s
pki_subsystem_signed_audit_log_path=%(pki_subsystem_log_path)s/signedAudit
pki_subsystem_tomcat_webapps_link=%(pki_subsystem_path)s/webapps
pki_tomcat_webapps_subsystem_path=%(pki_tomcat_webapps_path)s/%(pki_subsystem_type)s
pki_tomcat_webapps_subsystem_webinf_classes_path=%(pki_tomcat_webapps_subsystem_path)s/WEB-INF/classes
pki_tomcat_webapps_subsystem_webinf_lib_path=%(pki_tomcat_webapps_subsystem_path)s/WEB-INF/lib
pki_certsrv_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-certsrv.jar
pki_cmsbundle_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-cmsbundle.jar
pki_cmscore_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-cmscore.jar
pki_cms_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-cms.jar
pki_cmsutil_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-cmsutil.jar
pki_nsutil_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-nsutil.jar


# JAR paths
# These are used in the processing of pkispawn and are not supposed
# to be overwritten by user configuration files
pki_jss_jar=%(arch_java_lib)s/jss4.jar
pki_symkey_jar=%(arch_java_lib)s/symkey.jar
pki_apache_commons_collections_jar=/usr/share/java/apache-commons-collections.jar
pki_apache_commons_lang_jar=/usr/share/java/apache-commons-lang.jar
pki_apache_commons_logging_jar=/usr/share/java/apache-commons-logging.jar
pki_commons_codec_jar=/usr/share/java/commons-codec.jar
pki_httpclient_jar=/usr/share/java/httpcomponents/httpclient.jar
pki_httpcore_jar=/usr/share/java/httpcomponents/httpcore.jar
pki_javassist_jar=/usr/share/java/javassist.jar
pki_jettison_jar=/usr/share/java/jettison.jar
pki_ldapjdk_jar=/usr/share/java/ldapjdk.jar
pki_certsrv_jar=/usr/share/java/pki/pki-certsrv.jar
pki_cmsbundle=/usr/share/java/pki/pki-cmsbundle.jar
pki_cmscore=/usr/share/java/pki/pki-cmscore.jar
pki_cms=/usr/share/java/pki/pki-cms.jar
pki_cmsutil=/usr/share/java/pki/pki-cmsutil.jar
pki_resteasy_jaxrs_api_jar=%(resteasy_lib)s/jaxrs-api.jar
pki_nsutil=/usr/share/java/pki/pki-nsutil.jar
pki_tomcat_jar=/usr/share/java/pki/pki-tomcat.jar
pki_resteasy_atom_provider_jar=%(resteasy_lib)s/resteasy-atom-provider.jar
pki_resteasy_jaxb_provider_jar=%(resteasy_lib)s/resteasy-jaxb-provider.jar
pki_resteasy_jaxrs_jar=%(resteasy_lib)s/resteasy-jaxrs.jar
pki_resteasy_jettison_provider_jar=%(resteasy_lib)s/resteasy-jettison-provider.jar
pki_scannotation_jar=/usr/share/java/scannotation.jar
pki_tomcatjss_jar=/usr/share/java/tomcat7jss.jar
pki_velocity_jar=/usr/share/java/velocity.jar
pki_xerces_j2_jar=/usr/share/java/xerces-j2.jar
pki_xml_commons_apis_jar=/usr/share/java/xml-commons-apis.jar
pki_xml_commons_resolver_jar=/usr/share/java/xml-commons-resolver.jar
pki_jss_jar_link=%(pki_tomcat_common_lib_path)s/jss4.jar
pki_symkey_jar_link=%(pki_tomcat_common_lib_path)s/symkey.jar
pki_apache_commons_collections_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-collections.jar
pki_apache_commons_lang_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-lang.jar
pki_apache_commons_logging_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-logging.jar
pki_commons_codec_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-codec.jar
pki_httpclient_jar_link=%(pki_tomcat_common_lib_path)s/httpclient.jar
pki_httpcore_jar_link=%(pki_tomcat_common_lib_path)s/httpcore.jar
pki_javassist_jar_link=%(pki_tomcat_common_lib_path)s/javassist.jar
pki_resteasy_jaxrs_api_jar_link=%(pki_tomcat_common_lib_path)s/jaxrs-api.jar
pki_jettison_jar_link=%(pki_tomcat_common_lib_path)s/jettison.jar
pki_ldapjdk_jar_link=%(pki_tomcat_common_lib_path)s/ldapjdk.jar
pki_tomcat_jar_link=%(pki_tomcat_common_lib_path)s/pki-tomcat.jar
pki_resteasy_atom_provider_jar_link=%(pki_tomcat_common_lib_path)s/resteasy-atom-provider.jar
pki_resteasy_jaxb_provider_jar_link=%(pki_tomcat_common_lib_path)s/resteasy-jaxb-provider.jar
pki_resteasy_jaxrs_jar_link=%(pki_tomcat_common_lib_path)s/resteasy-jaxrs.jar
pki_resteasy_jettison_provider_jar_link=%(pki_tomcat_common_lib_path)s/resteasy-jettison-provider.jar
pki_scannotation_jar_link=%(pki_tomcat_common_lib_path)s/scannotation.jar
pki_tomcatjss_jar_link=%(pki_tomcat_common_lib_path)s/tomcatjss.jar
pki_velocity_jar_link=%(pki_tomcat_common_lib_path)s/velocity.jar
pki_xerces_j2_jar_link=%(pki_tomcat_common_lib_path)s/xerces-j2.jar
pki_xml_commons_apis_jar_link=%(pki_tomcat_common_lib_path)s/xml-commons-apis.jar
pki_xml_commons_resolver_jar_link=%(pki_tomcat_common_lib_path)s/xml-commons-resolver.jar
pki_ca_jar=/usr/share/java/pki/pki-ca.jar
pki_ca_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-ca.jar
pki_kra_jar=/usr/share/java/pki/pki-kra.jar
pki_kra_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-kra.jar
pki_ocsp_jar=/usr/share/java/pki/pki-ocsp.jar
pki_ocsp_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-ocsp.jar
pki_tks_jar=usr/share/java/pki/pki-tks.jar
pki_tks_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-tks.jar



###############################################################################
##  CA Configuration:                                                        ##
##                                                                           ##
##  Values in this section are common to CA subsystems including 'PKI CAs',  ##
##  'Cloned CAs', 'Subordinate CAs', and 'External CAs', and contain         ##
##  required information which MAY be overridden by users as necessary.      ##
##                                                                           ##
##     EXTERNAL CAs:  To specify an 'External CA', change the value          ##
##                    of 'pki_external' from 'False' to 'True'.              ##
##                                                                           ##
##  SUBORDINATE CAs:  To specify a 'Subordinate CA', change the value        ##
##                    of 'pki_subordinate' from 'False' to 'True'.           ##
##                                                                           ##
##         REMINDER:  PKI CA Clones, Subordinate CAs, and External CAs       ##
##                    are MUTUALLY EXCLUSIVE entities!!!                     ##
###############################################################################
[CA]
pki_ca_signing_key_algorithm=SHA256withRSA
pki_ca_signing_key_size=2048
pki_ca_signing_key_type=rsa
pki_ca_signing_nickname=caSigningCert cert-%(pki_instance_name)s CA
pki_ca_signing_signing_algorithm=SHA256withRSA
pki_ca_signing_subject_dn=cn=CA Signing Certificate,o=%(pki_security_domain_name)s
pki_ca_signing_token=Internal Key Storage Token
pki_external=False
pki_external_ca_cert_chain_path=
pki_external_ca_cert_path=
pki_external_csr_path=
pki_external_step_two=False
pki_import_admin_cert=False
pki_ocsp_signing_key_algorithm=SHA256withRSA
pki_ocsp_signing_key_size=2048
pki_ocsp_signing_key_type=rsa
pki_ocsp_signing_nickname=ocspSigningCert cert-%(pki_instance_name)s CA
pki_ocsp_signing_signing_algorithm=SHA256withRSA
pki_ocsp_signing_subject_dn=cn=CA OCSP Signing Certificate,o=%(pki_security_domain_name)s
pki_ocsp_signing_token=Internal Key Storage Token
pki_subordinate=False
pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
pki_admin_name=%(pki_admin_uid)s
pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
pki_admin_uid=caadmin
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s CA
pki_audit_signing_subject_dn=cn=CA Audit Signing Certificate,o=%(pki_security_domain_name)s
pki_ds_base_dn=o=%(pki_instance_name)s-CA
pki_ds_database=%(pki_instance_name)s-CA
pki_ds_hostname=%(pki_hostname)s
pki_subsystem_name=CA %(pki_hostname)s %(pki_https_port)s
pki_subsystem_nickname=subsystemCert cert-%(pki_instance_name)s CA
pki_subsystem_subject_dn=cn=CA Subsystem Certificate,o=%(pki_security_domain_name)s

# Paths
# These are used in the processing of pkispawn and are not supposed
# to be overwritten by user configuration files.
#
pki_source_emails=/usr/share/pki/ca/emails
pki_source_flatfile_txt=%(pki_source_conf_path)s/flatfile.txt
pki_source_profiles=/usr/share/pki/ca/profiles
pki_source_proxy_conf=%(pki_source_conf_path)s/proxy.conf
pki_source_registry_cfg=%(pki_source_conf_path)s/registry.cfg
pki_source_admincert_profile=%(pki_source_conf_path)s/adminCert.profile
pki_source_caauditsigningcert_profile=%(pki_source_conf_path)s/caAuditSigningCert.profile
pki_source_cacert_profile=%(pki_source_conf_path)s/caCert.profile
pki_source_caocspcert_profile=%(pki_source_conf_path)s/caOCSPCert.profile
pki_source_servercert_profile=%(pki_source_conf_path)s/serverCert.profile
pki_source_subsystemcert_profile=%(pki_source_conf_path)s/subsystemCert.profile
pki_subsystem_emails_path=%(pki_subsystem_path)s/emails
pki_subsystem_profiles_path=%(pki_subsystem_path)s/profiles




###############################################################################
##  KRA Configuration:                                                       ##
##                                                                           ##
##  Values in this section are common to KRA subsystems                      ##
##  including 'PKI KRAs' and 'Cloned KRAs', and contain                      ##
##  required information which MAY be overridden by users as necessary.      ##
###############################################################################
[KRA]
pki_import_admin_cert=True
pki_storage_key_algorithm=SHA256withRSA
pki_storage_key_size=2048
pki_storage_key_type=rsa
pki_storage_nickname=storageCert cert-%(pki_instance_name)s KRA
pki_storage_signing_algorithm=SHA256withRSA
pki_storage_subject_dn=cn=DRM Storage Certificate,o=%(pki_security_domain_name)s
pki_storage_token=Internal Key Storage Token
pki_transport_key_algorithm=SHA256withRSA
pki_transport_key_size=2048
pki_transport_key_type=rsa
pki_transport_nickname=transportCert cert-%(pki_instance_name)s KRA
pki_transport_signing_algorithm=SHA256withRSA
pki_transport_subject_dn=cn=DRM Transport Certificate,o=%(pki_security_domain_name)s
pki_transport_token=Internal Key Storage Token
pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
pki_admin_name=%(pki_admin_uid)s
pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
pki_admin_uid=kraadmin
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s KRA
pki_audit_signing_subject_dn=cn=KRA Audit Signing Certificate,o=%(pki_security_domain_name)s
pki_ds_base_dn=o=%(pki_instance_name)s-KRA
pki_ds_database=%(pki_instance_name)s-KRA
pki_ds_hostname=%(pki_hostname)s
pki_subsystem_name=KRA %(pki_hostname)s %(pki_https_port)s
pki_subsystem_nickname=subsystemCert cert-%(pki_instance_name)s KRA
pki_subsystem_subject_dn=cn=KRA Subsystem Certificate,o=%(pki_security_domain_name)s

# Paths
# These are used in the processing of pkispawn and are not supposed
# to be overwritten by user configuration files.
#
pki_source_servercert_profile=%(pki_source_conf_path)s/serverCert.profile
pki_source_storagecert_profile=%(pki_source_conf_path)s/storageCert.profile
pki_source_subsystemcert_profile=%(pki_source_conf_path)s/subsystemCert.profile
pki_source_transportcert_profile=%(pki_source_conf_path)s/transportCert.profile

###############################################################################
##  OCSP Configuration:                                                      ##
##                                                                           ##
##  Values in this section are common to OCSP subsystems                     ##
##  including 'PKI OCSPs' and 'Cloned OCSPs', and contain                    ##
##  required information which MAY be overridden by users as necessary.      ##
###############################################################################
[OCSP]
pki_import_admin_cert=True
pki_ocsp_signing_key_algorithm=SHA256withRSA
pki_ocsp_signing_key_size=2048
pki_ocsp_signing_key_type=rsa
pki_ocsp_signing_nickname=ocspSigningCert cert-%(pki_instance_name)s OCSP
pki_ocsp_signing_signing_algorithm=SHA256withRSA
pki_ocsp_signing_subject_dn=cn=OCSP Signing Certificate,o=%(pki_security_domain_name)s
pki_ocsp_signing_token=Internal Key Storage Token
pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
pki_admin_name=%(pki_admin_uid)s
pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
pki_admin_uid=ocspadmin
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s OCSP
pki_audit_signing_subject_dn=cn=OCSP Audit Signing Certificate,o=%(pki_security_domain_name)s
pki_ds_base_dn=o=%(pki_instance_name)s-OCSP
pki_ds_database=%(pki_instance_name)s-OCSP
pki_ds_hostname=%(pki_hostname)s
pki_subsystem_name=OCSP %(pki_hostname)s %(pki_https_port)s
pki_subsystem_nickname=subsystemCert cert-%(pki_instance_name)s OCSP
pki_subsystem_subject_dn=cn=OCSP Subsystem Certificate,o=%(pki_security_domain_name)s

###############################################################################
##  RA Configuration:                                                        ##
##                                                                           ##
##  Values in this section are common to PKI RA subsystems, and contain      ##
##  required information which MAY be overridden by users as necessary.      ##
###############################################################################
[RA]

###############################################################################
##  TKS Configuration:                                                       ##
##                                                                           ##
##  Values in this section are common to TKS subsystems                      ##
##  including 'PKI TKSs' and 'Cloned TKSs', and contain                      ##
##  required information which MAY be overridden by users as necessary.      ##
###############################################################################
[TKS]
pki_import_admin_cert=True
pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
pki_admin_name=%(pki_admin_uid)s
pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
pki_admin_uid=tksadmin
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s TKS
pki_audit_signing_subject_dn=cn=TKS Audit Signing Certificate,o=%(pki_security_domain_name)s
pki_ds_base_dn=o=%(pki_instance_name)s-TKS
pki_ds_database=%(pki_instance_name)s-TKS
pki_ds_hostname=%(pki_hostname)s
pki_subsystem_name=TKS %(pki_hostname)s %(pki_https_port)s
pki_subsystem_nickname=subsystemCert cert-%(pki_instance_name)s TKS
pki_subsystem_subject_dn=cn=TKS Subsystem Certificate,o=%(pki_security_domain_name)s

###############################################################################
##  TPS Configuration:                                                       ##
##                                                                           ##
##  Values in this section are common to PKI TPS subsystems, and contain     ##
##  required information which MAY be overridden by users as necessary.      ##
###############################################################################
[TPS]

# Paths
# These are used in the processing of pkispawn and are not supposed
# to be overwritten by user configuration files.
#
pki_subsystem_signed_audit_log_path=%(pki_subsystem_log_path)s/signedAudit