# 
# Certificate Extension configuration file for EJBCA
#
# This file defines the available certificate extensions to the system.
# Every extension should have a unique id of a number starting from 1 up
# to 255. It is important that they are in number order.
# 
# You can not start to use an extension and then remove it and shift the numbers. 
# That will confuse the configuration of EJBCA. The mapping in certificate profiles 
# is based on this numbering.
#
# Example Configuration (uncomment and set the proper values) :

# The unique OID of the extension (Required)
#id1.oid = 1.2.3.4  
 
# Classpath to the CertificateExtention implementing class. (Required)
#id1.classpath=org.ejbca.core.model.ca.certextensions.BasicCertificateExtension

# Display name of the extension in the 'Edit Certificate Profile' page (Required)
#id1.displayname=TESTEXTENSION 

# Defines if the extensions should be used or be disabled. (Required)
#id1.used=true

# If the display name should be translated in the language resources. (Required)
#id1.translatable=true

# Defines if the extension should be marked as critical in the certificate. (Required)
#id1.critical=false

# It is possible to define properties to the actual implementation of the
# CertificateExtention, for example does the BasicCerticateExtension require
# the properties 'encoding' and if dynamic is not true also 'value' must be set.
#id1.property.encoding=DERPRINTABLESTRING
#id1.property.dynamic=false
#id1.property.value=Hello World

# Example of another extension
#id2.oid = 1.2.3.5    
#id2.classpath=some.organization.CustomCertificateExtension
#id2.displayname=MYCUSTOM
#id2.used=true
#id2.translatable=false
#id2.critical=true
#id2.property.someproperty=1234
#id2.property.someotherproperty=1234

# Some real samples
#id1.oid = 2.16.840.1.113730.1.13  
#id1.classpath=org.cesecore.certificates.certificate.certextensions.BasicCertificateExtension
#id1.displayname=NetscapeComment 
#id1.used=true
#id1.translatable=false
#id1.critical=false
#id1.property.encoding=DERIA5STRING
#id1.property.dynamic=false
#id1.property.value=This is a Netscape Comment extensions

#id2.oid = 2.16.840.1.113730.1.4
#id2.classpath=org.cesecore.certificates.certificate.certextensions.BasicCertificateExtension
#id2.displayname=NetscapeCARevocationURL 
#id2.used=true
#id2.translatable=false
#id2.critical=false
#id2.property.encoding=DERIA5STRING
#id2.property.dynamic=false
#id2.property.value=https://ca.sample.foo/netscapeca.crl

#id3.oid = 2.16.840.1.113730.1.3  
#id3.classpath=org.cesecore.certificates.certificate.certextensions.BasicCertificateExtension
#id3.displayname=NetscapeRevocationURL 
#id3.used=true
#id3.translatable=false
#id3.critical=false
#id3.property.encoding=DERIA5STRING
#id3.property.dynamic=false
#id3.property.value=https://ca.sample.foo/netscape.crl

# The NetscapeCertType value is composed of bits counted from the left
#  bit-0 SSL client - this cert is certified for SSL client authentication use
#  bit-1 SSL server - this cert is certified for SSL server authentication use
#  bit-2 S/MIME - this cert is certified for use by clients
#  bit-3 Object Signing - this cert is certified for signing objects such as Java applets and plugins
#  bit-4 Reserved - this bit is reserved for future use
#  bit-5 SSL CA - this cert is certified for issuing certs for SSL use
#  bit-6 S/MIME CA - this cert is certified for issuing certs for S/MIME use
#  bit-7 Object Signing CA - this cert is certified for issuing certs for Object Signing

#id4.oid = 2.16.840.1.113730.1.1
#id4.classpath=org.cesecore.certificates.certificate.certextensions.BasicCertificateExtension
#id4.displayname=NetscapeCertType 
#id4.used=true
#id4.translatable=false
#id4.critical=false
#id4.property.encoding=DERBITSTRING
#id4.property.dynamic=false
#id4.property.value=10100000

# Using the DEROBJECT, you can supply an encoded ASN1Primitive as a hex-string, or
# even a DERSequence of objects.

#id5.oid=1.3.6.1.5.5.7.1.1
#id5.classpath=org.cesecore.certificates.certificate.certextensions.BasicCertificateExtension
#id5.displayname=AIA
#id5.used=true
#id5.translatable=true
#id5.critical=false
#id5.property.encoding=DEROBJECT
#id5.property.dynamic=false
#id5.property.value=302406082b06010505......

# Example for MS app policies extension. 
# This is a sequence with two oids for Smart Card Logon and Client Authentication
# You can easily copy the DEROBJECT from some other certificate by using 'openssl asn1parse -in cert.pem -i -dump'
#id6.oid=1.3.6.1.4.1.311.21.10
#id6.classpath=org.cesecore.certificates.certificate.certextensions.BasicCertificateExtension
#id6.displayname=MS app policies - "Smart card logon+Client authentication" 
#id6.used=true
#id6.translatable=false
#id6.critical=false
#id6.property.encoding=DEROBJECT
#id6.property.dynamic=false
#id6.property.value=301a300c060a2b060104018237140202300a06082b06010505070302

# Using property.dynamic=true for an BasicCertificateExtension the 
# property.value can be overridden at runtime by adding extension data in the  
# end entity's ExtendedInformation using the extension OID as key.
# If no such extension data is provided the extension first looks for the 
# property.value and if no such is provided it fails.
#
# In the example below the URL for the CRL can be overridden by putting the 
# value in the end entity's extended information as 
# extensiondata_2.16.840.1.113730.1.3.value=https://ca.sample.foo/someother.crl. 
# (using WS CLI you will omit the extensiondata_ part though)

#id7.oid = 2.16.840.1.113730.1.3  
#id7.classpath=org.cesecore.certificates.certificate.certextensions.BasicCertificateExtension
#id7.displayname=NetscapeRevocationURL 
#id7.used=true
#id7.translatable=false
#id7.critical=false
#id7.property.encoding=DERIA5STRING
#id7.property.dynamic=true
#id7.property.value=https://ca.sample.foo/netscape.crl

#id8.oid = 1.3.6.1.4.1.311.21.7  
#id8.classpath=org.cesecore.certificates.certificate.certextensions.BasicCertificateExtension
#id8.displayname=Certificate template v2 
#id8.used=true
#id8.translatable=false
#id8.critical=false
#id8.property.encoding=DEROBJECT
#id8.property.dynamic=true
#id8.property.value=302f06272b060104018237150884f09f0881fe9c1b85fd973886edbb1581edd122814981baed4185be9225020164020107

# Using the encoding RAW for an BasicCertificateExtensions, you can supply any 
# data as a hex-string to be used as the extension value.
# To be compliant with RFC5280 it should be properly DER encoded albeit invalid encoding will work (it is your responsibility).

#id9.oid = 1.2.3.5
#id9.classpath=org.cesecore.certificates.certificate.certextensions.BasicCertificateExtension
#id9.displayname=MYCUSTOM2
#id9.used=true
#id9.translatable=false
#id9.critical=false
#id9.property.encoding=RAW
#id9.dynamic=false
#id9.property.value=aabbccddeeff00
