mitmproxy/libmproxy/resources/cert.cnf

[ req ]
prompt = no
distinguished_name = req_distinguished_name
x509_extensions = v3_cert
req_extensions = v3_cert_req

[ req_distinguished_name ]
organizationName               = mitmproxy
commonName                     = %(commonname)s

[ v3_ca ]
basicConstraints = critical,CA:true
keyUsage = cRLSign, keyCertSign
nsCertType = sslCA

[ v3_ca_req ]
basicConstraints = critical,CA:true
keyUsage = cRLSign, keyCertSign
nsCertType = sslCA

[ v3_cert ]
basicConstraints = CA:false
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
nsCertType = server

[ v3_cert_req ]
basicConstraints = CA:false
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
nsCertType = server
%(altnames)s

[ alt_names ]
%(sans)s
Clean up certificate generation. - Use templates for config files. We can re-introduce customization of the certificate attributes when we need them. - Split CA and cert generation into separate functions. - Generation methods provide an error return when generation fails. - When the user explicitly specifies a certificate, we don't generate it, but fail if it doesn't exist. 2011-02-19 23:12:55 +00:00			`[ req ]`
			`prompt = no`
			`distinguished_name = req_distinguished_name`
			`x509_extensions = v3_cert`
			`req_extensions = v3_cert_req`

			`[ req_distinguished_name ]`
			`organizationName = mitmproxy`
			`commonName = %(commonname)s`

			`[ v3_ca ]`
			`basicConstraints = critical,CA:true`
			`keyUsage = cRLSign, keyCertSign`
			`nsCertType = sslCA`

			`[ v3_ca_req ]`
			`basicConstraints = critical,CA:true`
			`keyUsage = cRLSign, keyCertSign`
			`nsCertType = sslCA`

			`[ v3_cert ]`
			`basicConstraints = CA:false`
			`keyUsage = nonRepudiation, digitalSignature, keyEncipherment`
			`nsCertType = server`

			`[ v3_cert_req ]`
			`basicConstraints = CA:false`
			`keyUsage = nonRepudiation, digitalSignature, keyEncipherment`
			`nsCertType = server`
Fix problems with SANs and certificate generation. 2012-02-27 02:36:19 +00:00			`%(altnames)s`
Clean up certificate generation. - Use templates for config files. We can re-introduce customization of the certificate attributes when we need them. - Split CA and cert generation into separate functions. - Generation methods provide an error return when generation fails. - When the user explicitly specifies a certificate, we don't generate it, but fail if it doesn't exist. 2011-02-19 23:12:55 +00:00
Add upstream certificate lookup. This initiates a connection to the server to obtain certificate information to generate interception certificates. At the moment, the information used is the Common Name, and the list of Subject Alternative Names. 2012-02-27 02:05:45 +00:00			`[ alt_names ]`
			`%(sans)s`