\documentclass{report}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{textcomp}
\usepackage{geometry}
\geometry{top=15mm, bottom=15mm, left=1cm, right=1cm}
\usepackage[french]{babel}
\usepackage{pslatex}
\usepackage[colorlinks=true,urlcolor=black]{hyperref}
\usepackage{graphicx}
\usepackage{fancyhdr}
\pagestyle{fancy}
\renewcommand{\footrulewidth}{0.4pt}
\fancyfoot[L]{Uubu.fr}
\fancyfoot[R]{mar. mai 10 11:32:10 CEST 2016}
\lfoot{\Large \textit{Uubu.fr}}
\hypersetup{pdfinfo={
Title={openca - ocspd.conf},
Author={Sylvain Girod},
Creator={Bash script from uubu.fr's format version 1},
Producer={Bash script and PDFLaTeX},
Subject={Fichier de configuration pour openca-ocspd},
CreationDate={D:20160510113210},
ModDate={D:20160510113210},
Keywords={PKI;sécurité;chiffrement;certificats}
}}
\begin{document}
 
\begin{center}
{\Huge openca - ocspd.conf }
\end{center}
\vspace{1cm}
 
\begin{flushleft}
 
{\large Fichier de configuration pour openca-ocspd}
 
\vspace{10mm}
 
\hspace{1mm}  Le fichier de configuration est divisé en sections, et est conforme à la syntaxe spécifiée dans openssl-config.
\vspace{5mm} \\
 
 
\vspace{1cm}{\huge Exemple }
 
\
 
{\ttfamily
\texttt{[} ocspd \texttt{]}\\ default\_ocspd = OCSPD\_default\\ \hspace{2mm}\\ \texttt{[} OCSPD\_default \texttt{]}\\ \hspace{2mm}\\ dir = /usr/local/etc/ocspd\\ db = \$dir/index.txt\\ md = sha1\\ \hspace{2mm}\\ ca\_certificate = \$dir/certs/cacert.pem\\ ocspd\_certificate = \$dir/certs/ocspd\_cert.pem\\ ocspd\_key = \$dir/private/ocspd\_key.pem\\ pidfile = \$dir/ocspd.pid\\ \hspace{2mm}\\ user = ocspd\\ group = daemon\\ bind = *\\ port = 2560\\ max\_childs\_num = 5\\ max\_req\_size = 8192\\ \hspace{2mm}\\ request = ocsp\_req\\ response = ocsp\_response\\ \hspace{2mm}\\ dbms = dbms\_ldap \# Example using the LDAP for CRL retrivial\\ \hspace{2mm}\\ \#dbms = dbms\_file \# Example using file for CRL\\ \hspace{2mm}\\ engine = HSM \# ENGINE section\\ \hspace{2mm}\\ \#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\\ \texttt{[} ocsp\_req \texttt{]}\\ default\_keyfile = key.pem\\ \hspace{2mm}\\ \#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\\ \texttt{[} ocsp\_response \texttt{]}\\ dir = /usr/local/etc/ocspd\\ ocsp\_add\_response\_certs = \$dir/certs/chain\_certs.pem\\ ocsp\_add\_response\_keyid = yes\\ next\_update\_days = 0\\ next\_update\_mins = 5\\ \hspace{2mm}\\ \#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\\ \texttt{[} dbms\_ldap \texttt{]}\\ \hspace{2mm}\\ \# It is possible to use an URI to identify a CRL and/or the CA certificate, the general format is:\\ \# \texttt{[}protocol\texttt{]}://\texttt{[}user\texttt{[}:pwd\texttt{]}@\texttt{]}server\texttt{[}:port\texttt{]}/\texttt{[}path\texttt{]}\\ \#\\ \# where:\\ \# protocol - specifies the protocol to be used, supported are\\ \# file, ldap, http\\ \# user - is the user for auth (meaningful only if ldap or\\ \# http is used)\\ \# pwd - password used for auth (meaningful only if ldap\\ \# or http is used)\\ \# port - port to connect to (meaningful only if ldap or\\ \# http is used)\\ \# path - complete path to the object (meaningful only if\\ \# http is used)\\ \#\\ \# You can have the CRLs/CA certificates on a simple file\\ \# crl\_url = file:///usr/local/etc/ocspd/crl.pem\\ \#\\ \# You can retrieve the CRLs/CA certificates from a web server\\ \# crl\_urt = http://server/ca/cacert.der\\ \#\\ \# You can store the CRL into an LDAP server, simply\\ \# store it in certificateRevocationList;binary attribute\\ \#\\ \# There are different way, all legal, to specify the CRL\\ \# URL address:\\ \# crl\_url = ldap://user:pwd@ldap.server.org:389\\ \# crl\_url = ldap://ldap.server.org:389\\ crl\_url = ldap://localhost\\ \hspace{2mm}\\ \# The CRL entry DN is the DN to look for when retrieving the\\ \# date from the LDAP server. Put here the complete DN (usually\\ \# the DN of the CA's certificate).\\ crl\_entry\_dn = "email=email@address, cn=Certification Auth, \textbackslash{}\\ o=Organization, c=IT"\\ \hspace{2mm}\\ \#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\\ \texttt{[} dbms\_file \texttt{]}\\ \hspace{2mm}\\ \# You can have the CRL on a simple file in PEM format\\ crl\_url = file:///usr/local/etc/ocspd/crl.pem\\ \hspace{2mm}\\ \texttt{[} HSM \texttt{]}\\ \# Hardware accelerators support via the ENGINE interface\\ engine\_id = MyAccelerator\\ 0.engine\_pre = login:1:10:11:myPassword\\ \# 0.engine\_post = logout:1:10:11\\
}
\vspace{8mm}
 
\begin{description} \normalsize
\item[\hspace{1mm} default\_ocspd]{Dans cette section du fichier de configuration sont placés les options utilisées par le répondeur, certains sont disponibles en utilisant les options de la ligne de commande.}
\item[\hspace{1mm} db]{Spécifie la db où tout est concervé. Actuellement, le seul format fichier supporté est celui de openssl.}
\item[\hspace{1mm} md]{Spécifie le hash à utiliser. Défaut: sha1}
\item[\hspace{1mm} ca\_certificate]{Chemin vers de certificat de la CA}
\item[\hspace{1mm} ocspd\_certificate]{Chemin vers le certificat utilisé par le répondeur}
\item[\hspace{1mm} ocspd\_key]{Chemin de la clé privée du certificat utilisé par le répondeur}
\item[\hspace{1mm} pidfile]{fichier du pid du processus}
\item[\hspace{1mm} user]{UID du processus}
\item[\hspace{1mm} group]{GID du processus}
\item[\hspace{1mm} bind]{Adresse d'écoute}
\item[\hspace{1mm} port]{Port d'écoute}
\item[\hspace{1mm} threads\_num]{Nombre de threads qui devraient être créés au démarrage. plus le nombre est élevé, plus il peut gérer les fort trafics.}
\item[\hspace{1mm} chroot\_dir]{chroot d'application dans le répertoire spécifié}
\item[\hspace{1mm} max\_req\_size]{Taille maximum de requête reçue. Au delà la requête est détruite. Généralement les requêtes font environ 200/300 octets}
\item[\hspace{1mm} request section]{non utilisé actuellement}
\item[\hspace{1mm} response section]{Ici sont conservés les options pour la construction des réponses}
\item[\hspace{1mm} dbms]{Options pour la crl}
\item[\hspace{1mm} ocsp\_add\_response\_certs]{Chemin d'un fichier contentant les certificats à ajouter à la réponse (généralement toute la chaîne de certification).}
\item[\hspace{1mm} ocsp\_add\_response\_keyid]{Spécifie si l'id de clé est ajouté dans la réponse}
\item[\hspace{1mm} next\_update\_days]{Nombre de jours jusqu'à la prochaine mise à jours.}
\item[\hspace{1mm} next\_update\_mins]{idem pour la partie minutes. La réponse est valide pour days+mins}
\item[\hspace{1mm} ca\_url]{URI où le certificat de la CA est localisée. (file:// http:// ou ldap://)}
\item[\hspace{1mm} crl\_url]{URI où la crl est localisée (file:// http:// ou ldap://)}
\item[\hspace{1mm} crl\_entry\_dn]{avec ldap, spécifie le dn où rechercher l'attribut certificateRevocationList}
\item[\hspace{1mm} engine\_id]{Spécifie l'id de l'engine}
\item[\hspace{1mm} engine\_pre, engine\_post]{Paramètres d'initialisation du périphérique}
\end{description}
\end{flushleft}
\end{document}
