[ new_oids ]

# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7

[ main ]

# Comma-separated list of ips:ports to listen on.
# If the port is SSL, a letter s must be appended.
listening_ports = 127.0.0.1:2020
#listening_ports = 80,443s

# Allows clients to reuse TCP connection for subsequent HTTP requests, which improves performance.
enable_keep_alive = no

# Number of worker threads.
num_threads = 50

# Switch to given user credentials after startup.
# Required to run on privileged ports and not be run as root.
# run_as_user = uts-server

# Limit download speed for clients. throttle is a comma-separated list of key=value pairs:
# *                   limit speed for all connections
# x.x.x.x/mask        limit speed for specified subnet
# The value is a floating-point number of bytes per second, optionally followed by a k or m character
# meaning kilobytes and megabytes respectively. A limit of 0 means unlimited rate
throttle = *
#throttle = *=1k,10.10.0.0/16=10m,10.20.0.0/16=0

# Timeout for network read and network write operations, in milliseconds.
request_timeout_ms = 30000

# Path to the SSL certificate file. (PEM format containing private key and certificate)
#ssl_certificate = /etc/uts-server/cert.pem

# Enable client's certificate verification by the server.
#ssl_verify_peer = yes

# Name of a directory containing trusted CA certificates
#ssl_ca_path = /etc/ssl/ca/

# Path to a .pem file containing trusted certificates. The file may contain more than one certificate.
#ssl_ca_file = /etc/uts-server/ca.pem

# Sets maximum depth of certificate chain.
# If client's certificate chain is longer than the depth set here connection is refused.
#ssl_verify_depth = 9

# Loads default trusted certificates locations set at openssl compile time.
#ssl_default_verify_paths = yes

# see https://www.openssl.org/docs/manmaster/apps/ciphers.html for more detailed
#ssl_cipher_list = ALL:!eNULL

# Sets the minimal accepted version of SSL/TLS protocol according to the table:
# SSL2+SSL3+TLS1.0+TLS1.1+TLS1.2  0
# SSL3+TLS1.0+TLS1.1+TLS1.2       1
# TLS1.0+TLS1.1+TLS1.2            2
# TLS1.1+TLS1.2                   3
# TLS1.2                          4

#ssl_protocol_version = 3

# Enables the use of short lived certificates
#ssl_short_trust = no

# comma separated list of IP subnets to accept/deny
# deny all accesses, only allow 192.168/16 subnet
#access_control_allow_origin = -0.0.0.0/0,+192.168/16

# Enable TCP_NODELAY socket option on client connections.
tcp_nodelay = 0

# loglevel 
# debug, info, notice, warn, err, emerg, crit
log_level = info

####################################################################
[ tsa ]

default_tsa = tsa_config1	# the default TSA section

[ tsa_config1 ]

# These are used by the TSA reply generation only.
dir		= ./demoCA		# TSA root directory
serial		= ./tsaserial	# The current serial number (mandatory)
crypto_device	= builtin		# OpenSSL engine to use for signing
signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
					# (optional)
certs		= $dir/cacert.pem	# Certificate chain to include in reply
					# (optional)
signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)

default_policy	= tsa_policy1		# Policy if request did not specify it
					# (optional)
other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
digests		= md5, sha1		# Acceptable message digests (mandatory)
accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
clock_precision_digits  = 0	# number of digits after dot. (optional)
ordering		= yes	# Is ordering defined for timestamps?
				# (optional, default: no)
tsa_name		= yes	# Must the TSA name be included in the reply?
				# (optional, default: no)
ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
				# (optional, default: no)