- Renamed include directory to polarssl
diff --git a/programs/ssl/CA-HOWTO.txt b/programs/ssl/CA-HOWTO.txt
new file mode 100644
index 0000000..6f05211
--- /dev/null
+++ b/programs/ssl/CA-HOWTO.txt
@@ -0,0 +1,144 @@
+
+
+
+ How to setup your own Certificate Authority
+ ===========================================
+
+
+Note: this howto requires the openssl binary, as well as classic
+UNIX tools (cat, touch, echo). If you use Windows, please consider
+installing Cygwin -- see http://cygwin.com/
+
+
+ 1. Configure OpenSSL
+ --------------------
+
+First of all, create sslconf.txt in the current directory
+(a basic example is provided at the end of this file).
+
+cat > sslconf.txt <<"EOF"
+[paste contents here]
+EOF
+
+Then you need to create the database and a starting serial number:
+
+touch index
+echo "01" > serial
+mkdir newcerts
+
+
+ 2. Generate the CA certificate
+ ------------------------------
+
+openssl req -config sslconf.txt -days 3653 -x509 -newkey rsa:2048 \
+ -set_serial 0 -text -keyout test-ca.key -out test-ca.crt
+
+
+ 3. Generate the private keys and certificate requests
+ -----------------------------------------------------
+
+openssl genrsa -out server1.key 2048
+openssl genrsa -out server2.key 2048
+openssl genrsa -out client1.key 2048
+openssl genrsa -out client2.key 2048
+
+openssl req -config sslconf.txt -new -key server1.key -out server1.req
+openssl req -config sslconf.txt -new -key server2.key -out server2.req
+openssl req -config sslconf.txt -new -key client1.key -out client1.req
+openssl req -config sslconf.txt -new -key client2.key -out client2.req
+
+
+ 4. Issue and sign the certificates
+ ----------------------------------
+
+openssl ca -config sslconf.txt -in server1.req -out server1.crt
+openssl ca -config sslconf.txt -in server2.req -out server2.crt
+openssl ca -config sslconf.txt -in client1.req -out client1.crt
+openssl ca -config sslconf.txt -in client2.req -out client2.crt
+
+
+ 5. To revoke a certificate and update the CRL
+ ---------------------------------------------
+
+openssl ca -config sslconf.txt -revoke server1.crt
+openssl ca -config sslconf.txt -revoke client1.crt
+openssl ca -config sslconf.txt -gencrl -out crl.pem
+
+
+ 6. To display a certificate and verify its validity
+ ---------------------------------------------------
+
+openssl x509 -in server2.crt -text -noout
+cat test-ca.crt crl.pem > ca_crl.pem
+openssl verify -CAfile ca_crl.pem -crl_check server2.crt
+rm ca_crl.pem
+
+
+ 7. To export a certificate into a .pfx file
+ -------------------------------------------
+
+openssl pkcs12 -export -in client2.crt -inkey client2.key \
+ -out client2.pfx
+
+
+##================================================================
+##============== Example OpenSSL configuration file ==============
+##================================================================
+
+# References:
+#
+# /etc/ssl/openssl.conf
+# http://www.openssl.org/docs/apps/config.html
+# http://www.openssl.org/docs/apps/x509v3_config.html
+
+[ ca ]
+default_ca = my_ca
+
+[ my_ca ]
+certificate = test-ca.crt
+private_key = test-ca.key
+database = index
+serial = serial
+
+new_certs_dir = newcerts
+default_crl_days = 60
+default_days = 730
+default_md = sha1
+policy = my_policy
+x509_extensions = v3_usr
+
+[ my_policy ]
+countryName = optional
+stateOrProvinceName = optional
+organizationName = match
+organizationalUnitName = optional
+commonName = supplied
+emailAddress = optional
+
+[ req ]
+distinguished_name = my_req_dn
+x509_extensions = v3_ca
+
+[ my_req_dn ]
+countryName = Country Name..............
+countryName_min = 2
+countryName_max = 2
+stateOrProvinceName = State or Province Name....
+localityName = Locality Name.............
+0.organizationName = Organization Name.........
+organizationalUnitName = Org. Unit Name............
+commonName = Common Name (required)....
+commonName_max = 64
+emailAddress = Email Address.............
+emailAddress_max = 64
+
+[ v3_ca ]
+basicConstraints = CA:TRUE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer:always
+
+[ v3_usr ]
+basicConstraints = CA:FALSE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer
+