test/smime-certs/ca.cnf: clean up comments, simplify settings using SKID and AKID defaults
@@ -32,32 +32,30 @@ commonName = $ENV::CN
[ usr_cert ]
-# These extensions are added when 'ca' signs a request for an end entity
-# certificate
+# These extensions are added when 'ca' signs a request for a normal end-entity
+# certificate with key usage restrictions compatible with RSA keys
-basicConstraints=critical, CA:FALSE
+basicConstraints = CA:FALSE
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
-# PKIX recommendations harmless if included in all certificates.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid
+# Following SKID and AKID settings are meanwhile by default in all certificates.
+# See doc/man5/x509v3_config.pod for details.
+
+# subjectKeyIdentifier = hash
+# authorityKeyIdentifier = keyid, issuer
[ dh_cert ]
-# These extensions are added when 'ca' signs a request for an end entity
-# DH certificate
+# These extensions are added when 'ca' signs a request for an end-entity
+# DH certificate, for which only key agreement makes sense
-basicConstraints=critical, CA:FALSE
+basicConstraints = CA:FALSE
keyUsage = critical, keyAgreement
-# PKIX recommendations harmless if included in all certificates.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid
-
[ codesign_cert ]
# These extensions are added when 'ca' signs a request for a code-signing
-# end-entity certificate
+# end-entity certificate compatible with RSA and ECC keys
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature
@@ -65,13 +63,8 @@ extendedKeyUsage=codeSigning
[ v3_ca ]
+# Extensions for a typical CA as required by RFC 5280 etc.
+# SKID and AKID are by default set according to PKIX recommendation.
-# Extensions for a typical CA
-
-# PKIX recommendation.
-
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid:always
basicConstraints = critical, CA:true
keyUsage = critical, cRLSign, keyCertSign
-
