feat: port legacy TSYS-CA (admin-code PKI + tsys-bits) [#769][#783]

Excluded admin-code/*SECRETS.inc (real Nitrokey HSM PINs in the public source repo) — SECRETS.inc.example template added in their place. Rotation/history-purge ruling pending in #783. legacy-* trees exempt from lint/pointer checks (historical verbatim code). https://projects.knownelement.com/issues/769#note-4152
2026-09-04 07:01:46 -05:00
parent 2eca50490d
commit af7c0f3478
29 changed files with 738 additions and 3 deletions
@@ -0,0 +1,115 @@
+openssl_conf = openssl_init
+[ openssl_init ]
+engines = engines
+[ ca ]
+default_ca = ca_intermediate
+[ ca_root ]
+dir               = ca/root
+certs             = $dir/certs
+crl_dir           = $dir/crl
+new_certs_dir     = $dir/newcerts
+database          = $dir/database
+serial            = $dir/serial
+crlnumber         = $dir/crlnumber
+private_key       = label_root
+certificate       = $dir/certs/root.cert.pem
+crl               = $dir/crl/root.crl.pem
+crl_extensions    = ext_crl
+default_md        = sha256
+name_opt          = ca_default
+cert_opt          = ca_default
+default_crl_days  = 30
+default_days      = 3650
+preserve          = no
+policy            = policy_strict
+[ ca_intermediate ]
+dir               = intermediate
+certs             = $dir/certs
+crl_dir           = $dir/crl
+new_certs_dir     = $dir/newcerts
+database          = $dir/database
+serial            = $dir/serial
+crlnumber         = $dir/crlnumber
+private_key       = label_intermediate
+certificate       = $dir/certs/intermediate.cert.pem
+crl               = $dir/crl/intermediate.crl.pem
+crl_extensions    = ext_crl
+default_md        = sha256
+name_opt          = ca_default
+cert_opt          = ca_default
+default_crl_days  = 30
+default_days      = 375
+preserve          = no
+policy            = policy_loose
+[ policy_strict ]
+countryName             = match
+stateOrProvinceName     = match
+organizationName        = match
+organizationalUnitName  = optional
+commonName              = supplied
+emailAddress            = optional
+[ policy_loose ]
+countryName             = optional
+stateOrProvinceName     = optional
+localityName            = optional
+organizationName        = optional
+organizationalUnitName  = optional
+commonName              = supplied
+emailAddress            = optional
+[ req ]
+default_bits        = 2048
+string_mask         = utf8only
+default_md          = sha256
+distinguished_name  = req_distinguished_name
+[ req_distinguished_name ]
+countryName                     = Country Name (2 letter code)
+stateOrProvinceName             = State or Province Name
+localityName                    = Locality Name
+0.organizationName              = Organization Name
+organizationalUnitName          = Organizational Unit Name
+commonName                      = Common Name
+emailAddress                    = Email Address
+[ ext_root ]
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid:always, issuer
+basicConstraints        = critical, CA:true
+keyUsage                = critical, digitalSignature, cRLSign, keyCertSign
+[ ext_intermediate ]
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid:always, issuer
+basicConstraints        = critical, CA:true, pathlen:0
+keyUsage                = critical, digitalSignature, cRLSign, keyCertSign
+[ ext_client ]
+basicConstraints        = CA:FALSE
+nsCertType              = client, email
+nsComment               = "OpenSSL Generated Client Certificate"
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid, issuer
+keyUsage                = critical, nonRepudiation, digitalSignature, keyEncipherment
+extendedKeyUsage        = clientAuth, emailProtection
+[ ext_server ]
+basicConstraints        = CA:FALSE
+nsCertType              = server
+nsComment               = "OpenSSL Generated Server Certificate"
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid, issuer:always
+keyUsage                = critical, digitalSignature, keyEncipherment
+extendedKeyUsage        = serverAuth
+[ ext_crl ]
+authorityKeyIdentifier  = keyid:always
+[ ext_ocsp ]
+basicConstraints        = CA:FALSE
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid, issuer
+keyUsage                = critical, digitalSignature
+extendedKeyUsage        = critical, OCSPSigning
+
+[ engines ]
+pkcs11 = engine_pkcs11
+
+[ engine_pkcs11 ]
+engine_id     = pkcs11
+dynamic_path  = /usr/lib/x86_64-linux-gnu/engines-1.1/pkcs11.so
+MODULE_PATH   = /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
+
+init          = 1