#
# This .properties file describes default values for most system settings. Should any be undefined, 
# the values supplied here will be used.
#
# Note that some characters (such as commas) need to be escaped.
#

# Default values for properties

# Approvals
approval.defaultapprovalvalidity=28800
approval.defaultrequestvalidity=28800
approval.defaultmaxextensiontime=0
approval.excludedClasses=

# Cache
authorization.cachetime=30000
certprofiles.cachetime=1000
eeprofiles.cachetime=1000
approvalprofiles.cachetime=1000
globalconfiguration.cachetime=30000

# Backup 
# Backup/Restore hasn't been officially supported for some while, so from 6.5.0 is no longer included in the release. 
# Values are being left commented out in case functionality ever needs to be restored. 
# backup.prefix=cesecore_backup_
# backup.keyword.sourcefile=:sourceFile
# backup.keyword.databasesuperuserid=:databaseSuperUserId
# backup.keyword.databasesuperuserpassword=:databaseSuperUserPassword

# General password encryption key
password.encryption.key=qhrnf.f8743;12%#75
password.encryption.count=100

# CA Values
ca.cmskeystorepass=foo123 
ca.keystorepass=foo123
ca.rngalgorithm=SHA1PRNG
ca.serialnumberoctetsize=20
ca.toolateexpiredate=
certificate.validityoffset=-10m
ca.keepocspextendedservice=false

# CMP Values
cmp.tcp.bindadress=0.0.0.0
cmp.tcp.conffile=
cmp.tcp.enabled=false
cmp.tcp.logdir=./log
cmp.tcp.portno=829

# SCEP values
scep.defaultca=ManagementCA
scep.ra.createOrEditUser=false
scep.ra.namegenerationscheme=DN
scep.ra.namegenerationparameters=CN
scep.ra.namegenerationpostfix=
scep.ra.namegenerationprefix=

# Database
database.name=h2
database.username=sa
database.driver=h2
database.port=
database.host=
database.url=jdbc:h2:~/ejbcadb;DB_CLOSE_DELAY=-1
database.useSeparateCertificateTable=false
db.keepjbossserialization=false
db.keepinternalcakeystores=false

datasource.jndi-name-prefix=java:/
datasource.jndi-name=EjbcaDS

# Database Protection
databaseprotection.enabled=false
databaseprotection.erroronverifyfail=true

development.provider.installation=false

# External RA default datasources
externalra-database.driver=com.mysql.jdbc.Driver
# External RA GUI
externalra-gui.datasource.jdbc-url=jdbc:mysql://127.0.0.1/messages
externalra-gui.datasource.username=ejbca
externalra-gui.datasource.password=ejbca
# External RA SCEP server
scep.ra.datasource.jdbc-url=jdbc:mysql://127.0.0.1/messages
scep.ra.datasource.username=ejbca
scep.ra.datasource.password=ejbca

# ECDSA implicitly CA keys, special special
ecdsa.implicitlyca.a=7fffffffffffffffffffffff7fffffffffff8000000000007ffffffffffc
ecdsa.implicitlyca.b=6b016c3bdcf18941d0d654921475ca71a9db2fb27d1d37796185c2942c0a
ecdsa.implicitlyca.g=020ffa963cdca8816ccc33b8642bedf905c3d358573d3f27fbbd3b3cb9aaaf
ecdsa.implicitlyca.n=883423532389192164791648750360308884807550341691627752275345424702807307
ecdsa.implicitlyca.q=883423532389192164791648750360308885314476597252960362792450860609699839

# General
app.name.capital=EJBCA
app.version=${app.name.capital} ${app.version.number} (${svn.revision})
app.version.number=versionNotAvailable
ejbca.customavailableaccessrules=
ejbca.passwordlogrounds=1
ejbca.productionmode=true

svn.revision=revisionNotAvailable

forbidden.characters = \n\r;!\u0000%`?$~

# CLI 
ejbca.cli.defaultusername=ejbca
ejbca.cli.defaultpassword=ejbca

# Localization of log messages
intresources.preferredlanguage=en
intresources.secondarylanguage=en

# Mail
mail.contentencoding=UTF-8
mail.jndi-name=java:/EjbcaMail

# OCSP
ocsp.activation.doNotStorePasswordsInMemory=false
ocsp.audit-log=false
ocsp.audit-log-order=SESSION_ID:${SESSION_ID};LOG ID:${LOG_ID};\"${LOG_TIME}\";TIME TO PROCESS:${REPLY_TIME};\nOCSP REQUEST:\n\"${OCSPREQUEST}\";\nOCSP RESPONSE:\n\"${OCSPRESPONSE}\";\nSTATUS:${STATUS}
ocsp.audit-log-pattern=\\$\\{(.+?)\\}
ocsp.includesignercert=true
ocsp.includecertchain=true
ocsp.extensionclass=
ocsp.extensionoid=
ocsp.hardToken.className=se.primeKey.caToken.card.CardKeysImpl
ocsp.isstandalone=false
ocsp.keys.dir=./keys
ocsp.log-date=yyyy-MM-dd:HH:mm:ss:z
ocsp.log-safer=false
ocsp.log-timezone=GMT
ocsp.nonexistingisgood=false
ocsp.nonexistingisrevoked=false
ocsp.nonexistingisunauthorized=false
ocsp.p11.slot=1
ocsp.p11.sunConfigurationFile=
ocsp.rekeying.trigging.hosts=127.0.0.1
ocsp.rekeying.update.time.in.seconds=3600
ocsp.reqsigncertrevcachetime=60000
#ocsp.responderidtype is deprecated since 6.7.0
ocsp.responderidtype=keyhash
ocsp.restrictsignatures=false
ocsp.restrictsignaturesbymethod=issuer
ocsp.rekeying.safety.margin.in.seconds=86400
ocsp.signaturealgorithm=SHA256WithRSA;SHA256withRSAandMGF1;SHA384WithRSA;SHA512WithRSA;SHA224withECDSA;SHA256withECDSA;SHA384withECDSA;SHA512withECDSA;SHA1WithDSA
ocsp.signaturerequired=false
ocsp.signingCertsValidTime=300
ocsp.trx-log=false
ocsp.trx-log-order=${SESSION_ID};${LOG_ID};${STATUS};${REQ_NAME}\"${CLIENT_IP}\";\"${SIGN_ISSUER_NAME_DN}\";\"${SIGN_SUBJECT_NAME}\";${SIGN_SERIAL_NO};\"${LOG_TIME}\";${REPLY_TIME};${NUM_CERT_ID};0;0;0;0;0;0;0;\"${ISSUER_NAME_DN}\";${ISSUER_NAME_HASH};${ISSUER_KEY};${DIGEST_ALGOR};${SERIAL_NOHEX};${CERT_STATUS};${CERT_PROFILE_ID};${FORWARDED_FOR}
ocsp.trx-log-pattern=\\$\\{(.+?)\\}
ocsp.unidcacert=
ocsp.uniddatsource=
ocsp.unidtrustdir=

# Healthcheck
ocsphealthcheck.checkSigningCertificateValidity=true
ocsphealthcheck.signtest=true

healthcheck.amountfreemem=1
healthcheck.authorizedips=127.0.0.1
healthcheck.catokensigntest=false
healthcheck.classpath=org.ejbca.ui.web.pub.cluster.EJBCAHealthCheck
healthcheck.dbquery=Select 1 From CertificateData where fingerprint='XX'
healthcheck.maintenancepropertyname=DOWN_FOR_MAINTENANCE
healthcheck.okmessage=ALLOK
healthcheck.publisherconnections=false
healthcheck.sendservererror=true

# Secure audit log
securityeventsaudit.implementation.0=org.cesecore.audit.impl.log4j.Log4jDevice
securityeventsaudit.implementation.1=org.cesecore.audit.impl.integrityprotected.IntegrityProtectedDevice
securityeventsaudit.exporter.1=org.cesecore.audit.impl.AuditExporterXml

# trusted time
time.ntp.command=ntpq -p
time.ntp.pattern=\\*\\s*([^\\s]+)\\s+[^\\s]+\\s+([\\d]+)\\s+[\\w]+\\s+([\\d\\-]+)(m?)\\s+([\\d]+)(m?)\\s+[\\d]+\\s+[\\d\\.]+\\s+([\\-\\d\\.]+)\\s+[\\d\\.]+
time.provider=org.cesecore.time.providers.SimpleProvider

# Web
web.availablelanguages=en,bs,cs,de,fr,ja,pt,sv,uk,zh,vi
web.docbaseuri=internal
web.contentencoding=UTF-8
web.errorpage.notification
web.errorpage.stacktrace=false
hardtoken.diplaysensitiveinfo=true
httpsserver.hostname=localhost
httpserver.privhttps=8443
httpserver.external.privhttps=8443
httpserver.pubhttps=8442
httpserver.pubhttp=8080
web.openvpn.createInstallerScript=/usr/local/ejbca/bin/mk_openvpn_windows_installer.sh
web.renewalenabled=false
web.reqcertindb=true
# Web, known PKCS#11 crypto libraries
cryptotoken.p11.lib.10.name=SafeNet ProtectServer Gold Emulator
cryptotoken.p11.lib.10.file=/opt/ETcpsdk/lib/linux-x86_64/libctsw.so
cryptotoken.p11.lib.11.name=SafeNet ProtectServer Gold
cryptotoken.p11.lib.11.file=/opt/ETcpsdk/lib/linux-x86_64/libcryptoki.so
cryptotoken.p11.lib.20.name=SafeNet Luna SA
cryptotoken.p11.lib.20.file=/usr/lunasa/lib/libCryptoki2_64.so
cryptotoken.p11.lib.21.name=SafeNet Luna PCI
cryptotoken.p11.lib.21.file=/usr/lunapci/lib/libCryptoki2_64.so
cryptotoken.p11.lib.22.name=SafeNet Luna PCI
cryptotoken.p11.lib.22.file=/Program Files/LunaPCI/cryptoki.dll
cryptotoken.p11.lib.23.name=SafeNet Luna Client
cryptotoken.p11.lib.23.file=/usr/safenet/lunaclient/lib/libCryptoki2_64.so
cryptotoken.p11.lib.30.name=Utimaco
cryptotoken.p11.lib.30.file=/opt/utimaco/p11/libcs2_pkcs11.so
cryptotoken.p11.lib.31.name=Utimaco
cryptotoken.p11.lib.31.file=/opt/Utimaco/Software/PKCS11/lib/Linux-x86-64/libcs2_pkcs11.so
cryptotoken.p11.lib.32.name=Utimaco
cryptotoken.p11.lib.32.file=/etc/utimaco/libcs2_pkcs11.so
cryptotoken.p11.lib.33.name=Utimaco
cryptotoken.p11.lib.33.file=C:/Program Files/Utimaco/SafeGuard CryptoServer/Lib/cs2_pkcs11.dll
cryptotoken.p11.lib.40.name=nCipher
cryptotoken.p11.lib.40.file=/opt/nfast/toolkits/pkcs11/libcknfast.so
cryptotoken.p11.lib.50.name=ARX CoSign
cryptotoken.p11.lib.50.file=C:/windows/system32/sadaptor.dll
cryptotoken.p11.lib.60.name=OpenSC
cryptotoken.p11.lib.60.file=/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
cryptotoken.p11.lib.61.name=OpenSC
cryptotoken.p11.lib.61.file=/usr/lib/i386-linux-gnu/opensc-pkcs11.so
cryptotoken.p11.lib.62.name=OpenSC
cryptotoken.p11.lib.62.file=/usr/local/lib/opensc-pkcs11.so
cryptotoken.p11.lib.63.name=OpenSC
cryptotoken.p11.lib.63.file=C:/Windows/system32/opensc-pkcs11.dll
cryptotoken.p11.lib.64.name=OpenSC
cryptotoken.p11.lib.64.file=/usr/lib64/pkcs11/opensc-pkcs11.so
cryptotoken.p11.lib.70.name=Bull TrustWay CryptoBox
cryptotoken.p11.lib.70.file=/usr/lib64/libcryptobox_clnt.so
cryptotoken.p11.lib.71.name=Bull TrustWay PCI Crypto Card
cryptotoken.p11.lib.71.file=/usr/lib64/libgpkcs11cc2000.so
cryptotoken.p11.lib.72.name=Bull TrustWay Proteccio
cryptotoken.p11.lib.72.file=/usr/lib64/libnethsm64.so
cryptotoken.p11.lib.80.name=SoftHSM 2
cryptotoken.p11.lib.80.file=/usr/local/lib/softhsm/libsofthsm2.so
cryptotoken.p11.lib.81.name=SoftHSM 2
cryptotoken.p11.lib.81.file=/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so
cryptotoken.p11.lib.82.name=SoftHSM 2
cryptotoken.p11.lib.82.file=/usr/lib/softhsm/libsofthsm2.so
cryptotoken.p11.lib.83.name=SoftHSM 2
cryptotoken.p11.lib.83.file=/usr/lib64/pkcs11/libsofthsm2.so
cryptotoken.p11.lib.90.name=SoftHSM
cryptotoken.p11.lib.90.file=/usr/lib/softhsm/libsofthsm.so
cryptotoken.p11.lib.91.name=SoftHSM
cryptotoken.p11.lib.91.file=/usr/lib64/softhsm/libsofthsm.so
cryptotoken.p11.lib.100.name=PKCS11 Spy
cryptotoken.p11.lib.100.file=/usr/lib/x86_64-linux-gnu/pkcs11-spy.so
cryptotoken.p11.lib.101.name=PKCS11 Spy
cryptotoken.p11.lib.101.file=/usr/lib64/pkcs11/pkcs11-spy.so
cryptotoken.p11.lib.110.name=Utimaco R2
cryptotoken.p11.lib.110.file=/opt/utimaco/p11/libcs_pkcs11_R2.so
cryptotoken.p11.lib.111.name=Utimaco R2
cryptotoken.p11.lib.111.file=/opt/Utimaco/Linux/x86_64/Crypto_APIs/PKCS11_R2/lib/libcs_pkcs11_R2.so
cryptotoken.p11.lib.112.name=Utimaco R2
cryptotoken.p11.lib.112.file=/etc/utimaco/libcs_pkcs11_R2.so
cryptotoken.p11.lib.113.name=Cavium Nitrox III
cryptotoken.p11.lib.113.file=/home/liquidsec_bin/lib/libliquidsec_pkcs11.so
cryptotoken.p11.lib.114.name=AWS CloudHSM
cryptotoken.p11.lib.114.file=/opt/PrimeKey/cloudhsm/lib/libliquidsec_pkcs11.so
cryptotoken.p11.lib.114.canGenerateKey=false
cryptotoken.p11.lib.114.canGenerateKeyMsg=ClientToolBox must be used to generate keys on AWS CloudHSM

# Webservice
ejbcaws.enabled=true
ejbcaws.log-date=yyyy/MM/dd HH:mm:ss.SSS
ejbcaws.log-timezone=GMT
ejbcaws.trx-log=false
ejbcaws.trx-log-order=${LOG_TIME};${SESSION_ID};${LOG_ID};${REPLY_TIME};${METHOD};${ERROR_MESSAGE};${ADMIN_DN};${ADMIN_ISSUER_DN}
ejbcaws.trx-log-pattern=\\$\\{(.+?)\\}
jaxws.approval.gentokencerts=true
jaxws.approval.gethardtoken=true
jaxws.gentokens.setmslogononhold=false
jaxws.noauthonfetchuserdata=false
jaxws.numberofrequiredapprovals=1

# PKCS#11
pkcs11.disableHashingSignMechanisms=true
pkcs11.makeKeyUnmodifiableAfterGeneration=false

# CryptoToken
cryptotoken.keystorecache=true

# AuthenticationKeyBinding - Available cipher suites for outgoing connections
authkeybind.ciphersuite.0=TLSv1.2;TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
authkeybind.ciphersuite.1=TLSv1.2;TLS_RSA_WITH_AES_256_CBC_SHA256
authkeybind.ciphersuite.2=TLSv1.2;TLS_RSA_WITH_AES_128_CBC_SHA
authkeybind.ciphersuite.3=TLSv1;TLS_DHE_RSA_WITH_AES_256_CBC_SHA
authkeybind.ciphersuite.4=TLSv1;TLS_RSA_WITH_AES_256_CBC_SHA
authkeybind.ciphersuite.5=TLSv1;TLS_RSA_WITH_AES_128_CBC_SHA

# Statedump
statedump.templatebasedir=/opt/statedump_templates
