/etc/tigervnc/ssleay.cnf is in tigervnc-standalone-server 1.7.0+dfsg-8ubuntu2.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 | # This openssl configuration file is used to auto generate a self signed
# certificate for the -X509Cert and -X509Key options of the Xtigervnc server.
# The magic @HostName@ value is substituted by the fully qualified domain name
# of the machine. The openssl command used to auto generate the certificate is
# specified in /etc/vnc.conf with the $sslAutoGenCertCommand option.
#
# If the user wants their own certificate, instead of the on demand auto
# generated one, they can either specify it via the -X509Cert and -X509Key
# options to tigervncserver or replaces the auto generated files
# ~/.vnc/${HOSTFQDN}-SrvCert.pem and ~/.vnc/${HOSTFQDN}-SrvKey.pem in their
# home directory. These files will not be overwritten once generated by the
# tigervncserver wrapper script.
RANDFILE = /dev/urandom
[ req ]
default_bits = 4096
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
prompt = no
policy = policy_anything
req_extensions = v3_req
x509_extensions = v3_req
# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret
# This option specifies the digest algorithm to use. Possible values include
# md5 sha1 mdc2. If not present then MD5 is used. This option can be overridden
# on the command line.
default_md = sha256
# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only
[ req_distinguished_name ]
commonName = @HostName@
[ v3_req ]
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE
# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.
# This is OK for an SSL server.
nsCertType = server
# This is typical in keyUsage for a client certificate.
#keyUsage = nonRepudiation, digitalSignature, keyEncipherment
keyUsage = digitalSignature, keyEncipherment
# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
subjectAltName = @alt_names
[alt_names]
DNS.1 = @HostName@
DNS.2 = localhost
|