pkitool.conf

#  pkitool.conf
#
#  Defaults will be used for any variables which are
#  commented or removed. Command line options will
#  override any variables set here.

#  pki command ('ipsec pki' requires root on default installs)
#PKI="/usr/sbin/ipsec pki"
PKI="/usr/lib/ipsec/pki"

#  RSA private key size in bits
#SIZE=2048

#  X.509 certificate lifetime in days
#LIFETIME=1095

#  File Names
#
#  filename = <PREFIX><SUFFIX>.<FORMAT>

#  Prefix
CA="ca"
SERVER="server"
CLIENT="client"
PKCS12="client"

#  Suffix for Key, Cert, and PKCS #12
KEY="-key"
CERT="-cert"
P12=""

#  Suffix for PKCS #12 Files with CA Certificate
P12CA="-ca"

#  Format: binary "der" or text "pem"
FORMAT="pem"

#  Path for preexisting CA key and certificate
#  only used for server, client, and pkcs12.
#  Leave unspecified to read cakey and cacert with
#  filename <prefix><suffix>.<format> from the the
#  current directory.
#CAKEY=~/private/ca-key.pem
#CACERT=~/cert/ca/ca-cert.pem


#  subjectAltName and extendedKeyUsage
#
#  Both SAN and EKU are optional. However some VPN clients
#  expect the server certificate to include them.

#  SAN for server and client certificate
#  (e.g. FQDN, IP Address, Email)
SERVER_SAN="myvpn.mydynamicdns.com"
#CLIENT_SAN="myclient@mydomain.com"

#  EKU flag for server and client certificate
SERVER_FLAG="serverAuth"
#CLIENT_FLAG="clientAuth"


#  Distinguished Name (DN)
#
#  RDNs (partial list):
#
#   C     Country (two characters)
#   ST    State or province
#   L     Locality or town
#   O     Organization
#   OU    Organization Unit
#   CN    Common Name
#
#  DN is a sequence of RDNs:
#
#  "C=US, ST=New York, O=ABC Inc, OU=Sales, CN=Road Warrior"

#  These RDNs are not used by pkitool. They are only
#  defined locally to construct the DNs.
C="MY"
O="My Organization"
SERVER_CN="My Server"
CLIENT_CN="My Client"

#  DN
CA_DN="C=$C, O=$O, CN=$O CA"
SERVER_DN="C=$C, O=$O, CN=$SERVER_CN"
CLIENT_DN="C=$C, O=$O, CN=$CLIENT_CN"


#  PKCS #12

#  Friendly Name for key and certificate in PKCS #12
#FNAME="My Client"

#  Include CA certificate in PKCS #12 ("yes" or "no")
#WITHCA="no"

#  Friendly Name for CA in PKCS #12
#CANAME="$O CA"