# The name of the file equals the name of the profile

# Validity of certificates, can be in absolute or relative format
# absolute: YYYYMMDD[HH[MM[SS]]]
# relative +YY[MM[DD[HH[MM[SS]]]]] or -YY[MM[DD[HH[MM[SS]]]]]
# see OpenXPKI::DateTime for more details
validity:
    # notbefore defaults to now if it is omitted
    notbefore: 20120101000000
    # absolute date or relative to notbefore
    notafter: +0006

# digest to use
digest: sha256
# weather the serials must increase and how many bits of the serial are
# made from a random source
increasing_serials: 1
randomized_serial_bytes: 8

# weather to publish the certificate
publish: 1

style:
    00_basic_style:
        label: IPsec
        description: IPsec basic
        # Default style in bulk requests
        bulk: 0
        # Define which input fields you want on the UI
        # Just put their names here and define them at the end
        # in the "template" section.
        # You can also use the template names found in the
        # template.yaml file, if you duplicate a name, the
        # local definition gets precedence.
        ui:
            subject:
                - hostname
                - port
            info:
                - requestor_gname
                - requestor_name
                - requestor_email
                - comment

        # Subject is evaluated by template toolkit with the input data from the ui.subject fields
        # Note: Fields which have max > 1 are always passed as array
        subject: 
            dn: CN=[% hostname %][% IF port AND port != 443 %]:[% port %][% END %],DC=Test Deployment,DC=OpenXPKI,DC=org
        # You can use the fields from ui.subject here
            san: dns=[% hostname %]

    05_advanced_style:
        label: IPsec advanced
        description: IPsec advanced

        ui:
            subject:
                - cn
                - o
                - ou
                - dc
                - c
            san:
                - san_email
                - san_dns
                - san_ipv4
                - san_uri
                - san_guid
                - san_upn
                - san_rid
            info:
                - requestor_gname
                - requestor_name
                - requestor_email
                - comment

        # Subject is evaluated by template toolkit with the input data from the ui.subject fields
        # Note: Fields which have max > 1 are always passed as array
        subject: 
            dn: CN=[% hostname %][% IF port AND port != 443 %]:[% port %][% END %],DC=Test Deployment,DC=OpenXPKI,DC=org
        # No SAN definition here!
 

role:
    - Web Server

# Profile extensions - set 0/1 as needed
extensions:
    basic_constraints:
        critical: 1
        ca: 0
        path_length: 0 # FIXME?

    key_usage:
        critical: 0
        digital_signature: 0
        non_repudiation:   0
        key_encipherment:  0
        data_encipherment: 0
        key_agreement:     0
        key_cert_sign:     0
        crl_sign:          0
        encipher_only:     0
        decipher_only:     0

    extended_key_usage:
        critical: 0
        # these are OIDs, some OIDs are known and have names
        client_auth:      0
        server_auth:      1
        email_protection: 0
        code_signing:     0 
        time_stamping:    0
        # Any other oid can be given by number
        1.3.6.1.4.1.311.20.2.2: 0
        1.3.6.1.5.5.8.2.2: 1
        1.3.6.1.5.5.7.3.6: 1
        1.3.6.1.5.5.7.3.7: 1

    subject_key_identifier:
        critical: 0
        hash: 1

    authority_key_identifier:
        critical: 0
        keyid:  1
        issuer: 1

    issuer_alt_name:
        critical: 0
        # If the issuer has no subject alternative name, copying returns
        # an empty extension, which is problematic with both RSA SecurId
        # tokens and Cisco devices!
        copy: 1


    crl_distribution_points:
        critical: 0
        # uri can be scalar or list
        uri:
            - http://localhost/cacrl.crt
            - ldap://localhost/cn=[% ISSUER.CN.0 %],dc=OpenXPKI,dc=org

    authority_info_access:
        critical: 0
        # ca_issuers and ocsp can be scalar or list
        ca_issuers: http://localhost/cacert.crt
        ocsp: http://ocsp.openxpki.org/

    policy_identifier:
        critical: 0
        # WARNING: if use_loa is set to yes, the policy_identifier
        # will be extended by the values in the appropriate loa tag
        oid: 1.2.3.4
        
     # Not implemented in ssl code!
    cps:
        critical: 0
        # WARNING: if use_loa is set to yes, the cps will be
        # extended by the values in the appropriate loa tag
        uri: http://localhost/cps.html

    oid:
        1.3.6.1.4.1.311.20.2:
            critical: 0
            format: DER
            encoding: HEX
            value: 1e:1a:00:53:00:6d:00:61:00:72:00:74:00:63:00:61:00:72:00:64:00:55:00:73:00:65:00:72

    # This must be scalar or list of names 
    # FIXME: How is this defined?
    user_notice: section 

    netscape:
        comment:
            critical: 0
            text: This is a generic certificate. Generated with OpenXPKI trustcenter software.
        certificate_type:
            critical: 0
            ssl_client:        0
            smime_client:      0
            object_signing:    0
            ssl_client_ca:     0
            smime_client_ca:   0
            object_signing_ca: 0

        cdp:
            critical: 0
            # No lists - only one item allowed!
            uri: http://localhost/cacrl.crt
            ca_uri: http://localhost/cacrl.crt
     # end of netscape section
# end of extensions

# Define the input fields you used below here
#template:


