[DEFAULT]
enabled = no
ou =
lifetime = 120
ca = false
common name = RE_COMMON_NAME
key usage = digital_signature key_encipherment
extended key usage =

# Strongswan can automatically fetch CRL if
# CRL distribution point extension is included in the certificate
;revoked url =
revoked url = {{ revoked_url }}

# StrongSwan can automatically query OCSP responder if
# AIA extension includes OCSP responder URL
;responder url =
;responder url = no check
responder url = {{ responder_url }}

[ca]
enabled = yes
title = Certificate Authority
common name = ^ca
ca = true
key usage = key_cert_sign crl_sign
extended key usage =
lifetime = 1095

[rw]
enabled = yes
title = Roadwarrior
ou = Roadwarrior
common name = RE_HOSTNAME
extended key usage = client_auth

[srv]
enabled = yes
title = Server
ou = Server
common name = RE_FQDN
lifetime = 120
extended key usage = server_auth client_auth

[gw]
enabled = yes
title = Gateway
ou = Gateway
common name = RE_FQDN
renewable = true
lifetime = 120
extended key usage = server_auth 1.3.6.1.5.5.8.2.2 client_auth

[ap]
enabled = no
title = Access Point
ou = Access Point
common name = RE_HOSTNAME
lifetime = 120
extended key usage = client_auth

[mfp]
enabled = no
title = Printers
ou = MFP
common name = ^mfp\-
lifetime = 120
extended key usage = client_auth

[cam]
enabled = no
title = Camera
ou = IP Camera
common name = ^cam\-
lifetime = 120
extended key usage = client_auth

[ocsp]
enabled = no
title = OCSP Responder
common name = ^ocsp
lifetime = 7
responder url = nocheck
