acme_srv.cfg

configuration options for acme2certifier

Section	Option	Description	Values	default
`DEFAULT`	`debug`	Debug mode	True/False	False
`DEFAULT`	`proxy_server_list`	Proxy-server configuration	{"bar.local$": "http://10.0.0.1:3128", "foo.local$": "socks5://10.0.0.1:1080"}	None
`Account`	`ecc_only`	mandates the usage of ECC for account key generation	True/False	False
`Account`	`inner_header_nonce_allow`	allow nonce header on inner JWS during key-rollover	True/False	False
`Account`	`tos_check_disable`	turn off "Terms of Service" acceptance check	True/False	False
`Authorization`	`expiry_check_disable`	Disable authorization expiration	True/False	False
`Authorization`	`validity`	authorization validity in seconds	Integer	86400
`CAhandler`	`handler_file`	path and name of ca_handler file to be loaded. If not specified `acme_srv/ca_handler.py` will be loaded	examples/ca_handler/openssl_handler.py	`acme_srv/ca_handler.py`
`Certificate`	`revocation_reason_check_disable`	disable the check of revocation reason	True/False	False
`Certificate`	`cert_reusage_timeframe`	in case a csr will be resend within this timeframe (in seconds) the certificate already stored in the database will be returned and no enrollment will be triggered	Integer	0 (disabled)
`Certificate`	`enrollment_timeout`	timeout in seconds for asynchronous ca_handler threat	Integer	5
`Challenge`	`challenge_validation_disable`	disable challenge validation via http or dns. THIS IS A SEVERE SECURITY ISSUE! Please enable for testing/debugging purposes only.	True/False	False
`Challenge`	`challenge_validation_timeout`	Timeout in seconds for challenge validation	Integer	10
`Challenge`	`dns_server_list`	Use own dns servers for name resolution during challenge verification	["ip1", "ip2"]	[]
`Challenge`	`dns_validation_pause_timer`	pause interval in seconds after failed validation of a dns challenge	10	0.5
`Challenge`	`sectigo_sim`	provide `sectigo-email-01` challenges - Only for development and testing!	True/False	False
`DBhandler`	`dbfile`	path and name of database file. If not specified `acme_srv/acme_srv.db` will be used. Parameter is only available for a wsgi handler and will be ignored if django handler is getting used	'acme/database.db'	`acme_srv/acme_srv.db`
`Directory`	`db_check`	check database connection compare schemes and report as OK/NOK in meta information	True/False	False
`Directory`	`home`	homepage string to be shown when fetching the directory ressource	'string'	'https://github.com/grindsa/acme2certifier'
`Directory`	`supress_product_information`	Do not show product name, author and version when fetching the directory resource	True/False	False
`Directory`	`supress_version`	Do not show version information when fetching the directory resource	True/False	False
`Directory`	`tos_url`	Terms of Service URL	URL	None
`Directory`	`url_prefix`	url prefix for acme2certifier resources	'/foo'	None
`Helper`	`log_format`	Format of logging information	check the 'LogRecord attributes' Section of the python logging module	`%(message)s`
`Hooks`	`hooks_file`	path and name of hooks (for pre- and post-enrollment hooks) file to be loaded	None
`Hooks`	`ignore_pre_hook_failure`	True/False	False
`Hooks`	`ignore_post_hook_failure`	True/False	True
`Hooks`	`ignore_success_hook_failure`	True/False	False
`Message`	`signature_check_disable`	disable signature check of incoming JWS messages. THIS IS A SEVERE SECURITY ISSUE bypassing security checks and allowing message manipulations during transit. Please enable for testing/debugging purposes only.	True/False	False
`Nonce`	`nonce_check_disable`	disable nonce check. THIS IS A SECURITY ISSUE as it exposes the API for replay attacks! Should be enabled for testing/debugging purposes only.	True/False	False
`Order`	`expiry_check_disable`	Disable order expiration	True/False	False
`Order`	`header_info_list`	HTTP header fields to be passed to ca handler	["HTTP_USER_AGENT", "FOO_BAR"]	[]
`Order`	`retry_after_timeout`	Retry-After value to be send to client in case a certificate enrollment request gets pending on CA server	Integer	120
`Order`	`identifier_limit`	Maximum number of identifiers submitted in a single order request which translate later into SANs per certificate	Integer	20
`Order`	`tnauthlist_support`	accept TNAuthList identifiers and challenges containing tkauth-01 type	True/False	False
`Order`	`validity`	Order validity in seconds	Integer	86400