# module used to create signatures  default = use smartcard over PKCS#11
DIGIDOC_SIGN_IMPL=ee.sk.digidoc.factory.PKCS11SignatureFactory
# module used to get OCSP confirmations  now no longer required
#DIGIDOC_NOTARY_IMPL=ee.sk.digidoc.factory.IAIKNotaryFactory
# module used to verify timestamps
DIGIDOC_TIMESTAMP_IMPL=ee.sk.digidoc.factory.BouncyCastleTimestampFactory
# module used to get OCSP confirmations  free ware module
DIGIDOC_NOTARY_IMPL=ee.sk.digidoc.factory.BouncyCatsleNotaryFactory
# module used to parse digidoc files  default = use SAX parser
DIGIDOC_FACTORY_IMPL=ee.sk.digidoc.factory.SAXDigiDocFactory
# module used to canonicalize XML  default = use Apache XML Security library
CANONICALIZATION_FACTORY_IMPL=ee.sk.digidoc.factory.DOMCanonicalizationFactory
# optional module used to check signatures with CRL  not required
CRL_FACTORY_IMPL=ee.sk.digidoc.factory.CRLCheckerFactory
# XML-ENC parsers
ENCRYPTED_DATA_PARSER_IMPL=ee.sk.xmlenc.factory.EncryptedDataSAXParser
ENCRYPTED_STREAM_PARSER_IMPL=ee.sk.xmlenc.factory.EncryptedStreamSAXParser

# Java cryptographic libraries.
# default security library used in JDigiDoc  required even if you use
# also IAIK for other stuff like OCSP
DIGIDOC_SECURITY_PROVIDER=org.bouncycastle.jce.provider.BouncyCastleProvider
DIGIDOC_SECURITY_PROVIDER_NAME=BC
# used to be required for OCSP handling but newer BouncyCastle offers
# equivalent functionality, so you don't need this any more
IAIK_SECURITY_PROVIDER=iaik.security.provider.IAIK

# PKCS#11 settings
# EstID smartcard driver (used by private persons)
DIGIDOC_SIGN_PKCS11_DRIVER=esteid-pkcs11
# AID smartcard driver (used for example by companies)
#DIGIDOC_SIGN_PKCS11_DRIVER=pk2priv
# JNI shared object / dynamic link library to access PKCS#11
DIGIDOC_SIGN_PKCS11_WRAPPER=pkcs11rapper
# verification algorithm used in JDigiDoc
DIGIDOC_VERIFY_ALGORITHM=RSA/NONE/PKCS1Padding

# OCSP confirmation settings
# OCSP responders URL
DIGIDOC_OCSP_RESPONDER_URL=http://ocsp.sk.ee
# your HTTP proxy server settings if applicable
DIGIDOC_PROXY_HOST=<your proxy server name>
DIGIDOC_PROXY_PORT=<your proxy server port>
# Flag: sign your OCSP confirmations or not. Please not that most private
# persons have to sign the OCSP requests to get access to the server.
SIGN_OCSP_REQUESTS=true (or false for sending unsigned OCSP requests)
# OCSP confirmation server access token
DIGIDOC_PKCS12_CONTAINER=<full path to the PKCS#12 token file>
DIGIDOC_PKCS12_PASSWD=<PKCS#12 tokens password>
DIGIDOC_OCSP_SIGN_CERT_SERIAL=<serial number of the PKCS#12 tokens certificate
issued to you>
# OCSP responders certificate files and CN attributes
DIGIDOC_OCSP_COUNT=2
DIGIDOC_OCSP1_CN=ESTEID-SK OCSP RESPONDER
DIGIDOC_OCSP1_CERT=<path>\\esteid-ocsp.pem
DIGIDOC_OCSP1_CA_CERT=<path>\\esteid.pem
DIGIDOC_OCSP1_CA_CN=ESTEID-SK
DIGIDOC_OCSP2_CN=KLASS3-SK OCSP RESPONDER
DIGIDOC_OCSP2_CERT=<path>\\KLASS3-SK-OCSP.pem
DIGIDOC_OCSP2_CA_CERT=<path>\\KLASS3-SK.pem
DIGIDOC_OCSP2_CA_CN=KLASS3-SK
# OCSP or CRL selectors
DIGIDOC_CERT_VERIFIER=OCSP
DIGIDOC_SIGNATURE_VERIFIER=OCSP

# Logging settings
# log4j configurations file path. CHANGE THIS !
DIGIDOC_LOG4J_CONFIG=.\\.\\data\\jdigidoc\\SignatureLogging.cfg

# CA certificate locations
DIGIDOC_CA_CERTS=3
DIGIDOC_CA_CERT1=<path>\\juur.pem
DIGIDOC_CA_CERT2=<path>\\esteid.pem
DIGIDOC_CA_CERT3=<path>\\KLASS3-SK.pem

# CRL settings if required
CRL_USE_LDAP=false
CRL_FILE=esteid.crl
CRL_URL=http://www.sk.ee/crls/esteid/esteid.crl
CRL_SEARCH_BASE=cn=ESTEID-SK,ou=ESTEID,o=AS Sertifitseerimiskeskus,c=EE
CRL_FILTER=(certificaterevocationlist;binary=*)
CLR_LDAP_DRIVER=com.ibm.jndi.LDAPCtxFactory
CRL_LDAP_URL=ldap://194.126.99.76:389
CRL_LDAP_ATTR=certificaterevocationlist;binary
CRL_PROXY_HOST=<your proxy server name>
CRL_PROXY_PORT=<your proxy server port>

# Encryption settings
DIGDOC_ENCRYPT_KEY_ALG=AES
DIGIDOC_ENCRYPTION_ALOGORITHM=AES/CBC/PKCS7Padding
DIGIDOC_SECRANDOM_ALGORITHM=SHA1PRNG
DIGIDOC_KEY_ALOGORITHM=RSA/NONE/PKCS1Padding

# Timestamping settings
DIGIDOC_TSA_COUNT=1
DIGIDOC_TSA1_CERT=jar://certs/tsa_ns.crt
DIGIDOC_TSA1_CA_CERT=jar://certs/ts_cacert.crt
DIGIDOC_TSA1_USE_NONCE=true
DIGIDOC_TSA1_ASK_CERT=true
DIGIDOC_TSA1_URL=http://ns.szikszi.hu:8080/tsa
DIGIDOC_TSA1_CN=OpenTSA demo
DIGIDOC_TSA1_CA_CN=OpenTSA Root
DIGIDOC_TSA1_SN=12
MAX_TSA_TIME_ERR_SECS=1