Added code for inernal tls

Signed-off-by: Nischay Yadav <[email protected]>
nish112022 · Oct 14, 2024 · 92515f7 · 92515f7
1 parent d566b0c
commit 92515f7
Show file tree

Hide file tree

Showing 40 changed files with 2,629 additions and 110 deletions.
diff --git a/configs/cert1/ca.key b/configs/cert1/ca.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDB16f4wWQh21Vl
+u1LUFIeMyGZVjG0ya1+TVS2h1C/3nW82Ed+/eundfVN5LLMaRJ22Mu94njE9kz0g
++20bVghPC1P5lNJd4qivaq4FZkEe09sGVYSAOrm5etnCJQHoYJH7Epuusazb80a0
+ABzK5xKvYwi7qzqUss0GH4MvbF5oh3sMvsDMX1+saVRPhm5Nsl8gVukfOpCURdNs
+fj9or69IETmlM3RvLdqSjy87syQ7PmX9iKZj6pxvvFUPrXABNvcfw6qDvzXnFz3D
+HgWhNzz5MX5iL39b+mRnr0oyO/UxhcjmO8LZBMmOzZR3yh4qoEDaaX7L7o1AFiOQ
+hBmsdtXjAgMBAAECggEACnjQkb883hlfzS2oBV4Qjpn68U8zTQCA+tAktXPlnX5r
+ViP0Dv+gZ79QBaFVEau4S3IH/t+o8Fcme8QpeksVCtQlVrvj+391tnhQa2lBRl2S
+nQ58qILDqtIItpTSPBAPgt1X/MGLgZxsaugApjOCjmgOvji7YvIf4l9McoDrvsDO
+4s1G5l8dL0LI+F9f0rHuJAqU96FsU8c38/EuWC95zUiJB96pr4YfRhkImQKU7l6D
+6qJ/mmOhf0oLHZtaJUcZWERmZ2mEwiiT4077A64+dID/tX5jxYtXW4RrJyPQFpFi
+y8hN/rQxJzVkjlJprfUX2YnawQcPqopC+3mdYvu2/QKBgQDewZ+nuPj1eDYFRMs2
+fYrwBRymr3tFv8ld/Opbmcf9qYOKZvRnLBZcUQ1oaHTTvM3LWrC9Slc9tC3ZWDEj
+njPvyocxUG9Aui4CXSEoZ2TDBSyZ+zY3fxTAKDQTp39kAROnogU/Br8r5Ayw6LIU
+w9r8wA1HLWCKWCFvvhNiuQZ21QKBgQDexWEiksQxIJJNZ1SjOAopcQC0A58L+z0s
+k2VN0ZfnpkQN3NX8p4C2mkbVP0GACeweVLkEw+A9Xn7fPD3zxCMyLxz4wxlIK4yR
+fLOO+pufUUwicQRljKEHtyDIKY9ANwcN6ZHjzqSi89oIRmRtl03wSmSVaLMy6Pkv
+DQBTIAtl1wKBgQCMa6BaWYdPLk1XeutjWTaZYY+TH/HkoSauQf32anWg2RgbyhTt
+aORbo5iBJb/nrhBIzc22NcPTGN8CMM8hNdxln9UjaCIJupPAV7bMQolJSty34J1n
+1ItfKrjRXvg2MVuTg9YsyfL/Fw5NAxMndeN5CxQTt24xJ6dESpzr0dlaVQKBgEQV
+01A7xxa0u8JIeIfCEukDjpF2IeAJk3LSQb389w5ntJkAC67CiwZENK3sPVqirbW/
+cyTPsPNQtDoKMW0VXyRxXctx5YI3PSkiEcb7NSEGOdy06gEXcAfpom1KtmuL5e4M
+mvgjKhJbsSGiUgNkoP913TQE4fAHYFFPCfBd9N3VAoGBAIYYlJwuOK6bY0aGmuM6
+dCbrB0r6mbRE0+PoegMORoU/VENnHGBQqoxf4FaCM9SJ4i++7IeHbTIbYOkW1frA
+C30PyM2Nj4LvuAl8UwVUkLK0Xijbp+XITrcOyZ2ZHYQIAuQti++RGvBdjpLBYWyA
+wSaHTh5gLbv9ZdXYH2oE55nf
+-----END PRIVATE KEY-----
diff --git a/configs/cert1/ca.pem b/configs/cert1/ca.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDszCCApugAwIBAgIUa/W9LQD62MtJa0+S6cQ9Yd27OXgwDQYJKoZIhvcNAQEL
+BQAwaTELMAkGA1UEBhMCQ04xETAPBgNVBAgMCFNoYW5naGFpMREwDwYDVQQHDAhT
+aGFuZ2hhaTEPMA0GA1UECgwGbWlsdnVzMQ8wDQYDVQQLDAZtaWx2dXMxEjAQBgNV
+BAMMCWxvY2FsaG9zdDAeFw0yNDA5MDMxNDMxMjZaFw0zNDA5MDExNDMxMjZaMGkx
+CzAJBgNVBAYTAkNOMREwDwYDVQQIDAhTaGFuZ2hhaTERMA8GA1UEBwwIU2hhbmdo
+YWkxDzANBgNVBAoMBm1pbHZ1czEPMA0GA1UECwwGbWlsdnVzMRIwEAYDVQQDDAls
+b2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB16f4wWQh
+21Vlu1LUFIeMyGZVjG0ya1+TVS2h1C/3nW82Ed+/eundfVN5LLMaRJ22Mu94njE9
+kz0g+20bVghPC1P5lNJd4qivaq4FZkEe09sGVYSAOrm5etnCJQHoYJH7Epuusazb
+80a0ABzK5xKvYwi7qzqUss0GH4MvbF5oh3sMvsDMX1+saVRPhm5Nsl8gVukfOpCU
+RdNsfj9or69IETmlM3RvLdqSjy87syQ7PmX9iKZj6pxvvFUPrXABNvcfw6qDvzXn
+Fz3DHgWhNzz5MX5iL39b+mRnr0oyO/UxhcjmO8LZBMmOzZR3yh4qoEDaaX7L7o1A
+FiOQhBmsdtXjAgMBAAGjUzBRMB0GA1UdDgQWBBT2JD+0bHwTqhNXYZnClGC74QPt
+kzAfBgNVHSMEGDAWgBT2JD+0bHwTqhNXYZnClGC74QPtkzAPBgNVHRMBAf8EBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCEKmNgJ7Bu/nRUaihnx5xK5KIyeXLUpc8Z
+qvSs0sdjar+/liTIb/0U+kGxTgLV6RToioQS4QBwk6YOMTPx010WJ4DJSawqP2Xg
+IxI5PxK5hFihnQiWTJX3xBkZwRnI4CgoMRQyA2hF8l7VCW2F6/NlwWU1logYxIja
+e0JwSBJquy8OzI90avAMk7fv3oLPY4IOcsTLKg6kNeMf9d5dSDhgLmy1VOmm8jkl
+zs+DRqwwl+btDyQwRTZbwH4MBevU7J78ONNwKoL1pz6sApxgFo6Vxe/C4EKSgAvt
++634aw5UokTQRiKxPYovWCr97FBPgEi+8OOtV2fcpffdueglVLLY
+-----END CERTIFICATE-----
diff --git a/configs/cert1/client.csr b/configs/cert1/client.csr
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIDOzCCAiMCAQAwQzELMAkGA1UEBhMCQ04xDzANBgNVBAoMBm1pbHZ1czEPMA0G
+A1UECwwGbWlsdnVzMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQCtJXJL5oaOVpgerMvkL9UmPhQPh4YYVSUH7F0lfihy
+IaIwozU7hAQelrp9zg0c8YE2wWn8+ejOnQp/XQ55DWSzi1tjwDwnVr5euDkki108
+pHmEFYEHPkn3UUGplegxAVxOZdWlgc5wVKfpu+eMCllguY+8lrF3ZYJyduPAlhjU
+8gA2KUmwh7bu2hRE3s9p6PdCdKrH/EqKqoyxh/m0p/IuhHfiv3p9E2S3szJNoxYC
+0xwPSilRMwCj6io6fkcM4KqApqmNuM3fYoTwrE+RhO3FqdDbM6a3d653I7e5A72G
+oh0A5GU5M2CU8B+46ez1wL/03KxAGK93gCsxqsX1QJlpAgMBAAGggbIwga8GCSqG
+SIb3DQEJDjGBoTCBnjCBgwYDVR0RBHwweoIQbWlsdnVzLWluZGV4bm9kZYIMbWls
+dnVzLXByb3h5ghBtaWx2dXMtcm9vdGNvb3JkghFtaWx2dXMtcXVlcnljb29yZIIQ
+bWlsdnVzLWRhdGFjb29yZIIPbWlsdnVzLWRhdGFub2RlghBtaWx2dXMtcXVlcnlu
+b2RlMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgXgMA0GCSqGSIb3DQEBCwUAA4IBAQBP
+Q7mVMd7GArJuaNFJSphBzUURIuf6FQjeluk5kxgIRHLEu0Lxv6X/Kmugc8hdi9BI
+afEL3NvuzuZ7bVt6irhVeSRuNgmx513G/HkYpi6H16LYyj9x38AOCRnqD+XJ1yjR
+R3KwC/VTNVRLS7iv8qDdHCpNfPjtgwVKL9HS14rj/ztUw5JSWTizc/VycwOhaj+g
+2EckZ8uBPS1KCGQvPfdP63D0XuWU2PRuu4WBxH2u5qK1C0AlVzyKYqLl2IODH7Gk
+dkhVAjLsIRLoMfihoDYWO18rOKbfReerLoR7p4kk4UOifLyo4VU9sqFzG1vUbztr
+jogy6LVH0laQAjeYM69c
+-----END CERTIFICATE REQUEST-----
diff --git a/configs/cert1/client.key b/configs/cert1/client.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCtJXJL5oaOVpge
+rMvkL9UmPhQPh4YYVSUH7F0lfihyIaIwozU7hAQelrp9zg0c8YE2wWn8+ejOnQp/
+XQ55DWSzi1tjwDwnVr5euDkki108pHmEFYEHPkn3UUGplegxAVxOZdWlgc5wVKfp
+u+eMCllguY+8lrF3ZYJyduPAlhjU8gA2KUmwh7bu2hRE3s9p6PdCdKrH/EqKqoyx
+h/m0p/IuhHfiv3p9E2S3szJNoxYC0xwPSilRMwCj6io6fkcM4KqApqmNuM3fYoTw
+rE+RhO3FqdDbM6a3d653I7e5A72Goh0A5GU5M2CU8B+46ez1wL/03KxAGK93gCsx
+qsX1QJlpAgMBAAECggEAKtxNKcq73jpDV7yQkEDi85+EWb/DivxwuUBiYmiTXIVE
+3+NWxw/L8UKAkanTByolQUepk+zNG3A2bAa+EWsmVWeWzN+GRHqtj0btJkW1Y9CX
+IAIuuXtK1gTwSymHm7HphqKgu2Khlp7uHebcz4a0T0Q/94AaGCMxomIZyM+e//8r
+iUv7QMZsTAD8ilfoxe7Sh9gSK57UJUoqJ5zf8qf7OfHrPqct4rhzNlICqoxOivdL
+c5S1LOWW8uS7txRqs99WLSwDu+IaA+Q6a6DQMOVzTKWO7+jzS0nE5KeG/Y2EPPxz
+2s1D3tm5CV5eOlCBXbxRp2RunPwGusUNwK9B9T7y/QKBgQDbfNYA1hBP3ISeocLx
+V5JlSxBqA2/uK1sd4PoR/5GvZhezV+TE2A+jwQlOWb7Y9oFm1eG4yjjx8w8SZcXm
+nDr3+znUL5CHI4+aEg20ESb5b69ywMW4vWwjcESu+GseEmLDTqUVRwhOFPkjc25J
+we9Ij1tK9RLxJQCAULDrxNNvuwKBgQDJ8xqP9lLGpQ1qORNUH/JsLaphHyxXwz2U
+H0vfWfFCKyyaXnlenn4AxBXDX7OON2rGnaf9Xt4Y+MlQrHaTyKbta47/sQltiXdD
+DQZpW2JanuZhfRKHOp26C3TjJazfOqu/BBzGX6ANOlY1bowBqHgtOA60y2osG34o
+/0oRaVSvKwKBgGInhZyCHnFYcIZwWLmNLA7YbtK6Dsg341uNTMfXvtLtmRO+7rOI
+3BWjMgIz6EEmm9/dLkBxTt4EkGztzn6+xzA2zTmyu7Nzl7iS8kXglclexNtQkht3
+unBuuIh215BvMHOfK/xD89bXUkMkT+H0NIoCchUnW/0zSvIXI8eMEfIZAoGBAMGW
+8Zefoaoa/skc/ZJfLZzWCcYgg/l9h8I+XhU1uzia+p7ggahadp91WQd47j8ekJTk
+/Oy9zFpT42gaa3EvoBVoTiR+KXN/m3wDOGo22AnW2TILG3/WiOyXnu1AaH91Vr49
+yve/I0aK7ak616ufO9TdL/vQI280y7OxRed6+VsRAoGAcmErvfA0EQTzJr8qG3uv
+s5bL7XHFvsve8AYQ9wj+4LJXRm2caA/XskFjf41EH/+pHf1sDfXKbrZIi+O1vpNr
+H2yXVH0smfnrBZ8MRc6kytaROMzhsChXXIbtaDE/sV1hKRY2C8+htNdOjvGVBzoZ
+uoAOr9OxOxXIB1DjFL2bphw=
+-----END PRIVATE KEY-----
diff --git a/configs/cert1/client.pem b/configs/cert1/client.pem
@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIEHDCCAwSgAwIBAgIUEwau4SGcTvhF7Y0hX+/E1pyIEBUwDQYJKoZIhvcNAQEL
+BQAwaTELMAkGA1UEBhMCQ04xETAPBgNVBAgMCFNoYW5naGFpMREwDwYDVQQHDAhT
+aGFuZ2hhaTEPMA0GA1UECgwGbWlsdnVzMQ8wDQYDVQQLDAZtaWx2dXMxEjAQBgNV
+BAMMCWxvY2FsaG9zdDAeFw0yNDA5MDMxNDMxMjZaFw0zNDA5MDExNDMxMjZaMEMx
+CzAJBgNVBAYTAkNOMQ8wDQYDVQQKDAZtaWx2dXMxDzANBgNVBAsMBm1pbHZ1czES
+MBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEArSVyS+aGjlaYHqzL5C/VJj4UD4eGGFUlB+xdJX4ociGiMKM1O4QEHpa6fc4N
+HPGBNsFp/Pnozp0Kf10OeQ1ks4tbY8A8J1a+Xrg5JItdPKR5hBWBBz5J91FBqZXo
+MQFcTmXVpYHOcFSn6bvnjApZYLmPvJaxd2WCcnbjwJYY1PIANilJsIe27toURN7P
+aej3QnSqx/xKiqqMsYf5tKfyLoR34r96fRNkt7MyTaMWAtMcD0opUTMAo+oqOn5H
+DOCqgKapjbjN32KE8KxPkYTtxanQ2zOmt3eudyO3uQO9hqIdAORlOTNglPAfuOns
+9cC/9NysQBivd4ArMarF9UCZaQIDAQABo4HhMIHeMIGDBgNVHREEfDB6ghBtaWx2
+dXMtaW5kZXhub2RlggxtaWx2dXMtcHJveHmCEG1pbHZ1cy1yb290Y29vcmSCEW1p
+bHZ1cy1xdWVyeWNvb3JkghBtaWx2dXMtZGF0YWNvb3Jkgg9taWx2dXMtZGF0YW5v
+ZGWCEG1pbHZ1cy1xdWVyeW5vZGUwCQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwHQYD
+VR0OBBYEFPSIDDC9KH0GUBERB5OBuuRBqBKtMB8GA1UdIwQYMBaAFPYkP7RsfBOq
+E1dhmcKUYLvhA+2TMA0GCSqGSIb3DQEBCwUAA4IBAQAMcjcDqfEOXMr19xFg5Lsq
+01N7mZCGsdZpJgxqw541FZm6K8nZL8Ibi/42SR55jd6qt7wgOSKVoXWGzQAwgmA2
+SGQrWACwWUUXavdlA+OIW9pMAPhUELjdMwjES3AtYSqWngu1SyeF3zYjmRempueC
+zlTMd2951nE6Z0w5IMn/ACqDtzY15+kQhA7+3ZMPVxHDt9Kd3xqROLfhFaT/sbbD
+k026dwEakUsV49MZce259KpvecDYQZLFMJufe8QPV79KEF3CVD5SsLN8COVvHLk3
+kTxi4r9q+z9ErDBNAEKd1Pg95xEaDtboeBfgH5SnFg5sxFjRfm3wxg+XZ9t2GVT+
+-----END CERTIFICATE-----
diff --git a/configs/cert1/gen.sh b/configs/cert1/gen.sh
@@ -0,0 +1,22 @@
+Country="CN"
+State="Shanghai"
+Location="Shanghai"
+Organization="milvus"
+Organizational="milvus"
+CommonName="localhost"
+
+echo "generate ca.key"
+openssl genrsa -out ca.key 2048
+
+echo "generate ca.pem"
+openssl req -new -x509 -key ca.key -out ca.pem -days 3650 -subj "/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$Organizational/CN=$CommonName"
+
+echo "generate server SAN certificate"
+openssl genpkey -algorithm RSA -out server.key
+openssl req -new -nodes -key server.key -out server.csr -days 3650 -subj "/C=$Country/O=$Organization/OU=$Organizational/CN=$CommonName" -config ./openssl.cnf -extensions v3_req
+openssl x509 -req -days 3650 -in server.csr -out server.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cnf -extensions v3_req
+
+echo "generate client SAN certificate"
+openssl genpkey -algorithm RSA -out client.key
+openssl req -new -nodes -key client.key -out client.csr -days 3650 -subj "/C=$Country/O=$Organization/OU=$Organizational/CN=$CommonName" -config ./openssl.cnf -extensions v3_req
+openssl x509 -req -days 3650 -in client.csr -out client.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cnf -extensions v3_req
diff --git a/configs/cert1/openssl.cnf b/configs/cert1/openssl.cnf
@@ -0,0 +1,213 @@
+
+HOME            = .
+RANDFILE        = $ENV::HOME/.rnd
+
+oid_section     = new_oids
+
+
+[ new_oids ]
+
+
+tsa_policy1 = 1.2.3.4.1
+tsa_policy2 = 1.2.3.4.5.6
+tsa_policy3 = 1.2.3.4.5.7
+
+[ ca ]
+default_ca  = CA_default        # The default ca section
+
+[ CA_default ]
+
+dir     = ./demoCA      # Where everything is kept
+certs       = $dir/certs        # Where the issued certs are kept
+crl_dir     = $dir/crl      # Where the issued crl are kept
+database    = $dir/index.txt    # database index file.
+                    # several ctificates with same subject.
+new_certs_dir   = $dir/newcerts     # default place for new certs.
+
+certificate = $dir/cacert.pem   # The CA certificate
+serial      = $dir/serial       # The current serial number
+crlnumber   = $dir/crlnumber    # the current crl number
+                    # must be commented out to leave a V1 CRL
+crl     = $dir/crl.pem      # The current CRL
+private_key = $dir/private/cakey.pem# The private key
+RANDFILE    = $dir/private/.rand    # private random number file
+
+x509_extensions = usr_cert      # The extentions to add to the cert
+
+name_opt    = ca_default        # Subject Name options
+cert_opt    = ca_default        # Certificate field options
+
+copy_extensions = copy
+
+
+default_days    = 365           # how long to certify for
+default_crl_days= 30            # how long before next CRL
+default_md  = default       # use public key default MD
+preserve    = no            # keep passed DN ordering
+
+policy      = policy_match
+
+[ policy_match ]
+countryName     = match
+stateOrProvinceName = match
+organizationName    = match
+organizationalUnitName  = optional
+commonName      = supplied
+emailAddress        = optional
+
+[ policy_anything ]
+countryName     = optional
+stateOrProvinceName = optional
+localityName        = optional
+organizationName    = optional
+organizationalUnitName  = optional
+commonName      = supplied
+emailAddress        = optional
+
+[ req ]
+default_bits        = 2048
+default_keyfile     = privkey.pem
+distinguished_name  = req_distinguished_name
+attributes      = req_attributes
+x509_extensions = v3_ca # The extentions to add to the self signed cert
+
+
+string_mask = utf8only
+
+req_extensions = v3_req # The extensions to add to a certificate request
+
+[ req_distinguished_name ]
+countryName         = Country Name (2 letter code)
+countryName_default     = AU
+countryName_min         = 2
+countryName_max         = 2
+
+stateOrProvinceName     = State or Province Name (full name)
+stateOrProvinceName_default = Some-State
+
+localityName            = Locality Name (eg, city)
+
+0.organizationName      = Organization Name (eg, company)
+0.organizationName_default  = Internet Widgits Pty Ltd
+
+
+organizationalUnitName      = Organizational Unit Name (eg, section)
+
+commonName          = Common Name (e.g. server FQDN or YOUR name)
+commonName_max          = 64
+
+emailAddress            = Email Address
+emailAddress_max        = 64
+
+
+[ req_attributes ]
+challengePassword       = A challenge password
+challengePassword_min       = 4
+challengePassword_max       = 20
+
+unstructuredName        = An optional company name
+
+[ usr_cert ]
+
+
+
+basicConstraints=CA:FALSE
+
+
+
+
+
+
+
+nsComment           = "OpenSSL Generated Certificate"
+
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+
+
+
+
+
+[ v3_req ]
+subjectAltName = @alt_names
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+[ alt_names ]
+DNS.1 = milvus-indexnode
+DNS.2 = milvus-proxy
+DNS.3 = milvus-rootcoord
+DNS.4 = milvus-querycoord
+DNS.5 = milvus-datacoord
+DNS.6 = milvus-datanode
+DNS.7 = milvus-querynode
+
+[ v3_ca ]
+
+
+
+
+
+subjectKeyIdentifier=hash
+
+authorityKeyIdentifier=keyid:always,issuer
+
+basicConstraints = CA:true
+
+
+
+
+
+[ crl_ext ]
+
+
+authorityKeyIdentifier=keyid:always
+
+[ proxy_cert_ext ]
+
+
+basicConstraints=CA:FALSE
+
+
+
+
+
+
+
+nsComment           = "OpenSSL Generated Certificate"
+
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+
+
+
+
+proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
+
+[ tsa ]
+
+default_tsa = tsa_config1   # the default TSA section
+
+[ tsa_config1 ]
+
+dir     = ./demoCA      # TSA root directory
+serial      = $dir/tsaserial    # The current serial number (mandatory)
+crypto_device   = builtin       # OpenSSL engine to use for signing
+signer_cert = $dir/tsacert.pem  # The TSA signing certificate
+                    # (optional)
+certs       = $dir/cacert.pem   # Certificate chain to include in reply
+                    # (optional)
+signer_key  = $dir/private/tsakey.pem # The TSA private key (optional)
+
+default_policy  = tsa_policy1       # Policy if request did not specify it
+                    # (optional)
+other_policies  = tsa_policy2, tsa_policy3  # acceptable policies (optional)
+digests     = md5, sha1     # Acceptable message digests (mandatory)
+accuracy    = secs:1, millisecs:500, microsecs:100  # (optional)
+clock_precision_digits  = 0 # number of digits after dot. (optional)
+ordering        = yes   # Is ordering defined for timestamps?
+                # (optional, default: no)
+tsa_name        = yes   # Must the TSA name be included in the reply?
+                # (optional, default: no)
+ess_cert_id_chain   = no    # Must the ESS cert id chain be included?
+                # (optional, default: no)
diff --git a/configs/cert1/server.csr b/configs/cert1/server.csr
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIDOzCCAiMCAQAwQzELMAkGA1UEBhMCQ04xDzANBgNVBAoMBm1pbHZ1czEPMA0G
+A1UECwwGbWlsdnVzMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDo5OwXUQ70OtO5HNh/hgLprcTD0VJLDkA7RX2gbCfj
+WHxdTMu8kF86t4vh42vOjO6W3IKKFggg2jkXVWgyy52HDc4OMUM8kYjWTDlvf84A
+dP0/0oBsKGVt0sBcylGPuzNjk2OU7v43ETZZ+BgBe3DXRVtjJ5t/qdTB0ynk0tmv
+oOIniHJ2mslDkd1r5FmG2dWehOsCjxGhzw0thpV3l3xF9MhwR0sjivCcVJdXQ7nV
+pL7RrwPopfCNxIFVH+9sXeyymkl/zfycwL9eK41fXiwKbLAoKCGKajt9rV6Vjggt
+QonYlcnau7BEwE75PywBeIn0mdxIXHN3oJy12hmBo4FhAgMBAAGggbIwga8GCSqG
+SIb3DQEJDjGBoTCBnjCBgwYDVR0RBHwweoIQbWlsdnVzLWluZGV4bm9kZYIMbWls
+dnVzLXByb3h5ghBtaWx2dXMtcm9vdGNvb3JkghFtaWx2dXMtcXVlcnljb29yZIIQ
+bWlsdnVzLWRhdGFjb29yZIIPbWlsdnVzLWRhdGFub2RlghBtaWx2dXMtcXVlcnlu
+b2RlMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgXgMA0GCSqGSIb3DQEBCwUAA4IBAQDc
++pZ5nKONOQK6ovscirQ92bfTNwXR79k0RLvzQwhuq/O3d+9yma6N1sV2qZMnhDoD
+C68zMuvu8Ok5CBY6tN4qjz5eCqtiELgCA1qJhuJUqpPKS04/7JfMUdiAQSsIDxqP
+GiZvFGx1Vinwj0eMJ6lTGKwpyj1J7WvVCnMZ1T8InIEcaZwaCAjkk8BcidwEJ+Nv
+OAwvs9/EoMbhs+jOY1tbpz0sxuWPnX8cTZ6rTWAA8/2qZYs9XPjP2UqCTv+j8BY1
+if9/25DynFTG/drmswbM5GHAkPfeQ9fPqCf6o7qCAJMCYrgpOov9Bw+0D40oQTej
+jtT/R+EydvNtdEuIerVQ
+-----END CERTIFICATE REQUEST-----