NAME

     openscep.cnf - OpenSCEP configuration file


DESCRIPTION

     OpenSCEP uses the configuration file mechanism  provided  by
     OpenSSL  for its own configuration.  All the OpenSCEP utili-
     ties          read           the           configurationfile
     /usr/local/lib/openscep/openscep.cnf  where various sections
     describe parameters foreign to OpenSSL and  only  useful  to
     OpenSCEP.   See  the  next  sections  for  the configuration
     parameters specific to OpenSCEP.



SECTIONS

     There are three main sections used by OpenSCEP.  The CA sec-
     tions are more or less standard from OpenSSL.




CA DEFINITIONS

     See the OpenSSL documentation about details  of  the  confi-
     guration of a CA.



SCEPD DEFINITIONS

     These are the options  the  control  the  behaviour  of  the
     scepd(8)  programm  from the OpenSCEP distribution.  To keep
     the scripts that also use these variables simple, there  are
     no  defaults  for  them.  All  of them must be set, which is
     especially easy to do incorrectly when upgrading.


     name = CAname
          Name of this CA, used to find the right CA section dur-
          ing CA operations.


     cacert =
          Path to the PEM encoded CA certificate.


     cakey = /path/to/cakey.pem
          Path to the PEM encoded and unencrypted CA key.


     crl = /path/to/crl.pem
          Path to a PEM encoded certificate revokation list.


     grantcmd = /path/to/scepgrant
          Path to the scepgrant(8) program.

     automatic = {true|false}
          Specifies whether automatic enrollment is  possible  or
          not.


     debug = {true|false}
          Specifies whether debug output should be generated.


     logfile = /path/to/logfile
          Defines the log file. syslog(8) must be  configured  to
          direct log messages to this file.  This variable influ-
          ences only the CGI-program  used  to  display  the  log
          file.


     openssl = /path/to/openssl/binary
          Sets the fully qualified path to the openssl(1) binary.
          Note  that  on many installations, openssl(1) is not on
          the path, and there is no easy way for a CGI program to
          find  this program, hence the requirement that the path
          to it must be configured.


     crlusers = users
          This option allows to define a  white  space  separated
          list  of  users  (as  authenticated  by the web server)
          which are allowed to  perform  certificate  revocations
          without  specifying  the  challenge  password  from the
          request.


     crlpublic = {true|false}
          If set to true, public access to certificate revocation
          is  granted.  Any user who knows the challenge password
          of a certificate request can revoke  the  corresponding
          certificate.  Note that trusted users as defined in the
          crlusers variable are not required to  give  the  chal-
          lenge password, even if crlpublic is set to false.



LDAP SECTION

     In this section, all parameters needed to  access  the  ldap
     directory  are  defined.  There  are  no  defaults for these
     values, they must all be set in the configuration file (this
     simplifies the code for the CGI programs a little bit).


     ldaphost = ldapservername
          Specifies the name of the LDAP server used as back  end
          for the certificate data.

     ldapport = ldapserverport
          Specifies the TCP port number of the LDAP  server  used
          as back end for the certificate data.


     ldapbase = basedn
          The base distinguished name to be used by OpenSCEP.


     binddn = binddn
          Some of the  OpenSCEP  programms  need  to  update  the
          directory,  which requires additional privileges.  They
          therefore use this distinguished name to  bind  to  the
          directory,  and the password as specified by the bindpw
          variable (see below).


     bindpw = bindpw
          see binddn.


     ldapmodify = /path/to/ldapmodify
          Full path to the ldapmodify(1) programm to be  used  to
          modify  the  directory.  Note  that  a  binary from the
          OpenLDAP version 2 distribution must be  used,  as  the
          CGI   scripts   use  some  options  only  available  in
          OpenLDAP.


     ldapsearch = /path/to/ldapsearch
          program to be used to read the directory, only used  in
          the crl revocation program.



SEE ALSO

     The OpenSCEP distribution comes with an example openscep.cnf
     file  that one can use as a starting point when setting up a
     CA.



VERSION

     This page documents openscep.cnf as it  appears  in  version
     0.3.6 of OpenSCEP.



AUTHOR

     Andreas F. Mueller <andreas.mueller@othello.ch>






Man(1) output converted with man2html