config.tcl: New profile for devices which can't accept certificate updates.

[ca] / etc / config.tcl

diff --git a/etc/config.tcl b/etc/config.tcl
index 812b1d3..1c0a16c 100644 (file)
--- a/etc/config.tcl
+++ b/etc/config.tcl
@@ -26,6 +26,13 @@ set P(tls-server) {
   expire-interval 32
 }
 
+set P(tls-server-longterm) {
+  extensions tls-server-extensions
+  issue-time "*-*-* 00:00:00"
+  start-skew 1
+  expire-interval 43838
+}
+
 proc update-hook {} {
   exec 2>@stderr rsync -av --delete-after ca.cert crl cert req publish/
   exec 2>@stderr userv root publish-ca