keylime.conf

#=============================================================================
[general]
#=============================================================================

# Turn on or off TLS Keylime wide.
enable_tls = True

# Turn on or off DNS hostname checking for TLS certificates.
tls_check_hostnames = False

# Set which provider you want for the generation of certificates.
# Valid values are "cfssl" or "openssl". For cfssl to work, you must have the
# go binary installed in your path or in /usr/local/.
# Note: Revocation list generation is only supported by "cfssl".
ca_implementation = openssl

# The address and port of the revocation notifier service on the verifier from
# which either the cloud_agent or keylime_ca receive revocation events.
receive_revocation_ip = 127.0.0.1
receive_revocation_port = 8992

#=============================================================================
[cloud_agent]
#=============================================================================

# The binding address and port for the agent server
cloudagent_ip = 127.0.0.1
cloudagent_port = 9002

# Address and port where the verifier and tenant can connect to reach the agent.
# These keys are optional.
agent_contact_ip = 127.0.0.1
agent_contact_port = 9002

# The address and port of registrar server which agent communicate with
registrar_ip = 127.0.0.1
registrar_port = 8890

# The name of the RSA key that Keylime should use for protecting shares of U/V.
# If rsa_keyname is not a absolute path it is relative to /var/lib/keylime/secure.
rsa_keyname = tci_rsa_key

# Enable mTLS communication between agent, verifier and tenant.
# Details on why setting it to "False" is generally considered insecure can be found
# on https://github.com/keylime/keylime/security/advisories/GHSA-2m39-75g9-ff5r
mtls_cert_enabled = True

# The name of the X509 certificate that is used for mTLS. Uses the rsa_keyname as a key.
# If mtls_cert is not a absolute path it is relative to /var/lib/keylime/secure.
# This certificate must be self signed.
mtls_cert = tci_mtls_cert

# The CA that signs the client certificates of the tenant and verifier.
# If set to default it tries to use /var/lib/keylime/cv_ca/cacert.crt
keylime_ca = default

# The name that should be used for the encryption key, placed in the
# /var/lib/keylime/secure/ directory.
enc_keyname = derived_tci_key

# The name that should be used for the optional decrypted payload, placed in
# the /var/lib/keylime/secure directory.
dec_payload_file = decrypted_payload

# The size of the memory-backed tmpfs partition where Keylime stores crypto keys.
# Use syntax that the 'mount' command would accept as a size parameter for tmpfs.
# The default below sets it to 1 megabyte.
secure_size = 1m

# Use this option to set the TPM ownerpassword to something you want to use.
# Set it to "generate" if you want Keylime to choose a random owner password
# for you.
tpm_ownerpassword = keylime

# Whether to allow the cloud_agent to automatically extract a zip file in
# the delivered payload after it has been decrypted, or not. Defaults to "true".
# After decryption, the archive will be unzipped to a directory in /var/lib/keylime/secure.
# Note: the limits on the size of the tmpfs partition set above with the 'secure_size'
# option will affect this.
extract_payload_zip = True

# The agent's UUID.
# If you set this to "generate", Keylime will create a random UUID.
# If you set this to "hash_ek", Keylime will set the UUID to the result
# of 'SHA256(public EK in PEM format)'.
# If you set this to "environment", Keylime will use the value of the
# environment variable "KEYLIME_AGENT_UUID" as UUID.
# If you set this to "dmidecode", Keylime will use the UUID from
# 'dmidecode -s system-uuid'.
# If you set this to "hostname", Keylime will use the full qualified domain
# name of current host as the agent id.
agent_uuid = d432fbb3-d2f1-4a97-9ef7-75bd81c00000

# Whether to listen for revocation notifications from the verifier or not.
listen_notifications = True

# The path to the certificate to verify revocation messages received from the
# verifier.  The path is relative to /var/lib/keylime.
# If set to "default", Keylime will use the file RevocationNotifier-cert.crt
# from the unzipped contents provided by the tenant.
revocation_cert = default

# A comma-separated list of Python scripts to run upon receiving a revocation
# message. Keylime will verify the signature first, then call these Python
# scripts with the json revocation message.  The scripts must be located in
# the 'revocation_actions' directory.
#
# Keylime will also get the list of revocation actions from the file
# action_list in the unzipped contents provided by the verifier.
# All actions must be named local_action_[some name].
revocation_actions=

# A script to execute after unzipping the tenant payload.  This is like
# cloud-init lite =)  Keylime will run it with a /bin/sh environment and
# with a working directory of /var/lib/keylime/secure/unzipped.
payload_script=autorun.sh

# In case mTLS for the agent is disabled and the use of payloads is still
# required, this option has to be set to "True" in order to allow the agent 
# to start. Details on why this configuration (mTLS disabled and payload enabled)
# is generally considered insecure can be found on 
# https://github.com/keylime/keylime/security/advisories/GHSA-2m39-75g9-ff5r
enable_insecure_payload = False

# Jason @henn made be do it! He wanted a way for Keylime to measure the
# delivered payload into a pcr of choice.
# Specify a PCR number to turn it on.
# Set to -1 or any negative or out of range PCR value to turn off.
measure_payload_pcr=-1

# Wether or not to use an exponantial backoff algorithm for retries.
exponential_backoff = True

# Either how long to wait between failed attempts to communicate with the TPM
# in seconds, or the base for the exponential backoff algorithm.
# Floating point values accepted here.
retry_interval = 2

# Integer number of retries to communicate with the TPM before giving up.
max_retries = 4

# TPM2-specific options, allows customizing default algorithms to use.
# Specify the default crypto algorithms to use with a TPM2 for this agent.
# On kernel versions less than 5.10 choose sha1 as hash algorithm, because
# otherwise IMA attestation will fail.
#
# Currently accepted values include:
# - hashing:    sha512, sha384, sha256 or sha1
# - encryption: ecc or rsa
# - signing:    rsassa, rsapss, ecdsa, ecdaa or ecschnorr
tpm_hash_alg = sha1
tpm_encryption_alg = rsa
tpm_signing_alg = rsassa

# If an EK is already present on the TPM (e.g., with "tpm2_createek") and
# you require Keylime to use this EK, change "generate" to the actual EK
# handle (e.g. "0x81000000"). The Keylime agent will then not attempt to
# create a new EK upon startup, and neither will it flush the EK upon exit.
ek_handle = generate

# The user account to switch to to drop privileges when started as root
# If left empty, the agent will keep running with high privileges.
# The user and group specified here must allow the user to access the
# WORK_DIR (typically /var/lib/keylime) and /dev/tpmrm0. Therefore,
# suggested value for the run_as parameter is keylime:tss.
# The following commands should be used to set ownership before running the
# agent:
# chown keylime /var/lib/keylime
#
# If tpmdata.yml already exists:
# chown keylime /var/lib/keylime/tpmdata.yml
#
# If cv_ca directory exists:
# chown keylime /var/lib/keylime/cv_ca
# chown keylime /var/lib/keylime/cv_ca/cacert.crt
#
run_as =

#=============================================================================
[cloud_verifier]
#=============================================================================

# Unique identifier for the each verifier instances.
cloudverifier_id = default

# The IP address and port of verifier server binds to
cloudverifier_ip = 127.0.0.1
cloudverifier_port = 8881

# The address and port of registrar server that verifier communicates with
registrar_ip = 127.0.0.1
registrar_port = 8891

# Cloud Verifier (CV) TLS options.  This is for authenticating the CV itself,
# authenticating the users of the CV and securing the transmission of keys.
# The 'tls_dir' option will place Certificate Authority (CA) certificates and
# files for TLS in the /var/lib/keylime/ directory.
#
# Set to "generate" to automatically generate a CA/certificates in the 'cv_ca'
# directory.
# Note: if set to "generate", the 'ca_cert', 'my_cert', and 'private_key'
# options must all be set to "default".
# If you specify "generate", you can manage the CA that the verifier will create
# using keylime_ca -d /var/lib/keylime/cv_ca/.
tls_dir = generate

# The filename of the CA cert for verifying client certificates, placed in the
# 'tls_dir' directory.
ca_cert = default

# The filename of the cloud verifier certificate and private key, placed in the
# 'tls_dir' directory.
# The following two options also take the value "default" to find files
# with names such as <fully_qualified_domain_name>-cert.crt and
# <fully_qualified_domain_name>-private.pem for the cert and private key,
# respectively.
my_cert = default
private_key = default

# Set the password needed to decrypt the private key file.
# This should be set to a strong password.
# If 'tls_dir = generate', this password will also be used to protect the
# generated CA private key.
private_key_pw = default

# Whether verifier validates client certificate
check_client_cert = True

# Registrar client TLS options. This allows the CV to authenticate the
# registar before asking for AIKs.
# This option sets the directory where the CA certificate for the registrar
# can be found.
# Use "default" to use the value of 'reg_ca' (this points it to the directory
# automatically created by the registrar if it is set to "generate").
# Use "CV" to use 'cv_ca', the directory automatically created (and shared
# with the registar) by the CV.
registrar_tls_dir = CV

# The following three options set the filenames where the CA certificate,
# client certificate, and client private key file are, relative to the 'tls_dir'.
# If 'tls_dir = default', then default values will be used for 'ca_cert = cacert.crt',
# 'my_cert = client-cert.crt', and 'private_key = client-private.pem'.
registrar_ca_cert = default
registrar_my_cert = default
registrar_private_key = default

# Set the password needed to decrypt the registrar private key file.
# This should be set to a strong password.
# If you are using the auto generated keys from the CV, set the same password
# here as you did for 'private_key_pw' above.
registrar_private_key_pw = default

# mTLS configuration for connecting to the agent.
# Details on why setting it to "False" is generally considered insecure can be found
# on https://github.com/keylime/keylime/security/advisories/GHSA-2m39-75g9-ff5r
agent_mtls_cert_enabled = True
# Set 'agent_mtls_cert' to 'CV' for using the CV CA for the connections.
agent_mtls_cert = CV
agent_mtls_private_key =
agent_mtls_private_key_pw =

# Database URL Configuration
# See this document https://keylime-docs.readthedocs.io/en/latest/installation.html#database-support
# for instructions on using different database configurations.
# There are two options for the specification of the database connection configuration.
# 1) A tuple of parameters (e.g., database_drivername, database_username, database_password)
# 2) A single string in database_url. This, when set, takes precedence over the previous option.
# An example of database_url value for using sqlite:
#   sqlite:////var/lib/keylime/cv_data.sqlite
# An example of database_url value for using mysql:
#   mysql+pymysql://keylime:keylime@keylime_db:[port]/verifier?charset=utf8
# If database_url is not set, the default is "sqlite", using method 1, and will be
# located at "/var/lib/keylime/cv_data.sqlite".
database_url =
database_drivername = sqlite
database_username = ''
database_password = ''
database_host = ''
database_name = cv_data.sqlite
# Limits for DB connection pool size in sqlalchemy (https://docs.sqlalchemy.org/en/14/core/pooling.html#api-documentation-available-pool-implementations)
database_pool_sz_ovfl=5,10

auto_migrate_db = True


# The number of worker processes to use for the cloud verifier.
# Set to "0" to create one worker per processor.
multiprocessing_pool_num_workers = 0

# Wether or not to use an exponantial backoff algorithm for retries.
exponential_backoff = True

# Either how long to wait between failed attempts to connect to a cloud agent
# in seconds, or the base for the exponential backoff algorithm.
# Floating point values accepted here.
retry_interval = 2

# Number of retries to connect to an agent before giving up. Must be an integer.
max_retries = 5

# Time between integrity measurement checks, in seconds.  If set to "0", checks
# will done as fast as possible.  Floating point values accepted here.
quote_interval = 2

# Whether to turn on the zero mq based revocation notifier system.
# Currently this only works if you are using keylime-CA.
revocation_notifier = True

# The binding address and port of the revocation notifier service.
# If the 'revocation_notifier' option is set to "true", then the verifier
# automatically starts the revocation service.
revocation_notifier_ip = 127.0.0.1
revocation_notifier_port = 8992

# Enable revocation notifications via webhook. This can be used to notify other
# systems that do not have a Keylime agent running.
revocation_notifier_webhook = False

# Webhook url for revocation notifications.
webhook_url = ''

# The verifier limits the size of upload payloads (allowlists) which defaults to
# 100MB (104857600 bytes). This setting can be raised (or lowered) based on the
# size of the actual payloads
max_upload_size = 104857600

# The name of the boot attestation policy to use in comparing a measured boot event log
# with a measured boot reference state.
# A policy is a Python object that `isinstance` of `keylime.elchecking.policies.Policy`
# and was registered by calling `keylime.elchecking.policies.register`.
# The keylime agent extracts the measured boot event log.
# The verifier client specifies the measured boot reference state to use;
# this is specified independently for each agent.
# Depending on the policy, the same reference state may be usable with multiple agents.
# The `accept-all` policy ignores the reference state and approves every log.
measured_boot_policy_name = accept-all

# This is a comma-separated list of Python modules to dynamically load,
# for example to register additional boot attestation policies.
# Empty strings in the list are ignored
# (e.g., a value of `a,b,` means the same thing as `a,b`).
# A module here may be relative, in which case it is interpreted
# relative to the keylime.elchecking package.
# The default value for this config item is the empty string.
# measured_boot_imports = keylime.elchecking

# Severity labels for revocation events strictly ordered from least severity to
# highest severtiy.
severity_labels = ["info", "notice", "warning", "error", "critical", "alert", "emergency"]

# Severity policy that matches different event_ids to the severity label.
# The rules are evaluated from the beginning of the list and the first match is
# used. The event_id can also be a regex. Default policy assigns the highest
# severity to all events.
severity_policy = [{"event_id": ".*", "severity_label": "emergency"}]

# If files are already opened when IMA tries to measure them this causes
# a time of measure, time of use (ToMToU) error entry.
# By default we ignore those entries and only print a warning.
# Set to True to treat ToMToU entries as errors.
tomtou_errors = False

#=============================================================================
[tenant]
#=============================================================================

# The default Verifier server address and port if not specified in the command
cloudverifier_ip = 127.0.0.1
cloudverifier_port = 8881

# The default Registrar server address and port if not specified in the command
registrar_ip = 127.0.0.1
registrar_port = 8891

# Tenant client TLS options.

# This is for authenticating the CV itself and proving that the tenant is
# allowed talk to the CV.
# The 'tls_dir' option will look for client certificates for talking to the CV
# in the /var/lib/keylime/ directory.
# Set to "default" to use the CA setup by the cloud_verifier on the same machine.
# Fles will be in the /var/lib/keylime/cv_ca/ directory.
tls_dir = default

# The following three options set the filenames where the CA certificate,
# client certificate, and client private key file are, relative to the 'tls_dir'.
# If 'tls_dir = default', then default values will be used for 'ca_cert = cacert.crt',
# 'my_cert = client-cert.crt', and 'private_key = client-private.pem'.
ca_cert = default
my_cert = default
private_key = default

# mTLS configuration for connecting to the agent.
# Details on why setting it to "False" is generally considered insecure can be found
# on https://github.com/keylime/keylime/security/advisories/GHSA-2m39-75g9-ff5r
agent_mtls_cert_enabled = True
# Set 'agent_mtls_cert' to 'CV' for using the CV CA for the connections.
agent_mtls_cert = CV
agent_mtls_private_key =
agent_mtls_private_key_pw =

# EK certificate storage location (directory).
tpm_cert_store = /var/lib/keylime/tpm_cert_store/

# Set the password needed to decrypt the private key file.
# This should be set to a strong password.
# if you are using the auto generated keys from the CV, set the same password
# here as you did for 'private_key_pw' in the [cloud_verifier] section.
private_key_pw = default

# Registrar client TLS options. This allows the tenant to authenticate the
# registar before asking for AIKs.
# this option sets the directory where the CA certificate for the registrar
# can be found
# use "default" to use 'reg_ca' (this points it to the directory automatically
# created by the registrar if it is set to "generate"
# use "CV" to use 'cv_ca', the directory automatically created (and shared
# with the registar) by the CV
registrar_tls_dir = CV

# The following three options set the filenames where the registrar CA certificate,
# client certificate, and client private key file are, relative to the 'tls_dir'.
# if 'tls_dir = default', then default values will be used for 'ca_cert = cacert.crt',
# 'my_cert = client-cert.crt', and 'private_key = client-private.pem'.
registrar_ca_cert = default
registrar_my_cert = default
registrar_private_key = default

# Set the password needed to decrypt the private key file.
# This should be set to a strong password.
# if you are using the auto generated keys from the CV, set the same password
# here as you did for 'private_key_pw' in the [cloud_verifier] section.
registrar_private_key_pw = default

# Max size of a payload the tenant will take, in bytes (default 1 megabyte).
# Make sure this matches with the value of the 'secure_size' option in the
# [cloud_agent] section.
# Don't send things bigger than the tmpfs where they will be decrypted.
max_payload_size = 1048576

# TPM policies are json structures that takes a list of accepted
# Platform Configuration Registers (PCR) values and will match any in the list
# for that PCR.  These can be a mixture of any hashing algorithms, potentially
# of varying digest lengths (the default policy below supports SHA1, SHA-256
# and SHA-512).
# Note that you can't set a policy on PCR10 and PCR16 because Keylime uses
# them internally.
tpm_policy = {"22":["0000000000000000000000000000000000000001","0000000000000000000000000000000000000000000000000000000000000001","000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001","ffffffffffffffffffffffffffffffffffffffff","ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff","ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"],"15":["0000000000000000000000000000000000000000","0000000000000000000000000000000000000000000000000000000000000000","000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"]}

# Same as 'tpm_policy' but for virtual PCRs.
vtpm_policy = {"23":["ffffffffffffffffffffffffffffffffffffffff","0000000000000000000000000000000000000000"],"15":"0000000000000000000000000000000000000000"}

# Specify the file containing allowlists for processing Linux IMA measurements
# this file is used if tenant provides "default" as the allowlist file
# this file should be in the form
# SHA1sum path_to_file
ima_allowlist = allowlist.txt

# Specify a file containing paths that should be ignored by IMA.
# WARNING: use with great caution as it will affect the security of IMA.
ima_excludelist = exclude.txt

# Specify the acceptable crypto algorithms to use with the TPM for this agent.
# Only algorithms specified below will be allowed for usage by an agent.  If an
# agent uses an algorithm not specified here, it will fail validation.
#
# Currently accepted values include:
# hashing:    sha512, sha384, sha256 and sha1
# encryption: ecc and rsa
# signing:    rsassa, rsapss, ecdsa, ecdaa and ecschnorr
accept_tpm_hash_algs = sha512,sha384,sha256,sha1
accept_tpm_encryption_algs = ecc,rsa
accept_tpm_signing_algs = ecschnorr,rsassa

# Wether or not to use an exponantial backoff algorithm for retries.
exponential_backoff = True

# Either how long to wait between failed attempts to connect to a cloud agent
# in seconds, or the base for the exponential backoff algorithm.
# Floating point values accepted here.
retry_interval = 2

# Number of retries to connect to a agent before giving up. Must be an integer.
max_retries = 5

# Tell the tenant whether to require an EK certificate from the TPM.
# If set to False the tenant will ignore EK certificates entirely.
#
# WARNING: SETTING THIS OPTION TO FALSE IS VERY DANGEROUS!!!
#
# If you disable this check, then you may not be talking to a real TPM.
# All the security guarantees of Keylime rely upon the security of the EK
# and the assumption that you are talking to a spec-compliant and honest TPM.

# Some physical TPMs do not have EK certificates, so you may need to set
# this to "False" for some deployments.  If you do set it to "False", you
# MUST use the 'ek_check_script' option below to specify a script that will
# check the provided EK against a allowlist for the environment that has
# been collected in a trustworthy way.  For example, the cloud provider
# might provide a signed list of EK public key hashes.  Then you could write
# an ek_check_script that checks the signature of the allowlist and then
# compares the hash of the given EK with the allowlist.
require_ek_cert = True

# Optional script to execute to check the EK and/or EK certificate against a
# allowlist or any other additional EK processing you want to do. Runs in
# /var/lib/keylime. You call also specify an absolute path to the script.
# Script should return 0 if the EK or EK certificate are valid.  Any other
# return value will invalidate the tenant quote check and prevent
# bootstrapping a key.
#
# The various keys are passed to the script via environment variables:
# EK - contains a PEM encoded version of the public EK
# EK_CERT - contains a DER encoded EK certificate if one is available.
# PROVKEYS - contains a json document containing EK, EKcert, and AIK from the
# provider.  EK and AIK are in PEM format.  The EKcert is in base64 encoded
# DER format.
#
# Set to blank to disable this check.  See warning above if require_ek_cert
# is "False".
ek_check_script=

#=============================================================================
[registrar]
#=============================================================================

# The registrar's IP address and port used to communicate with other services
# as well as the bind address for the registrar server.
registrar_ip = 127.0.0.1
registrar_port = 8890
registrar_tls_port = 8891

# Further IP and port settings needed when using the Xen vTPM.
provider_registrar_port = 8990
provider_registrar_tls_port = 8991
provider_registrar_ip = 127.0.0.1

# Registrar TLS options.  This is for authenticating the registrar to clients
# who want to query AIKs.
# The 'tls_dir' option wil place CA certificates and files for TLS in the /var/lib/keylime/
# directory.
#
# Set to "generate" to automatically generate a CA/certificates in the 'reg_ca'
# directory.
# Note: if you specify "generate", you can manage the CA that the verifier will create
# using keylime_ca -d /var/lib/keylime/reg_ca/.
#
# Set to "CV" to share the CA with the cloud verifier (which must be run first
# once before starting the registrar so it can generate the keys).
tls_dir = CV

# The filename (in 'tls_dir') for the registrar's CA cert.
ca_cert = default

# The filename (in 'tls_dir') of the registrar certificate and private key.
# The following two options also take the value "default" to find files
# with names such as <fully_qualified_domain_name>-cert.crt and
# <fully_qualified_domain_name>-private.pem for the cert and private key,
# respectively.
my_cert = default
private_key = default

# Set the password needed to decrypt the private key file.
# This should be set to a strong password.
# If 'tls_dir = generate', this password will also be used to protect the
# generated CA private key.
private_key_pw = default

# Registrar client TLS options. This allows the registrar to authenticate the
# provider registrar before asking for AIKs.
# This option sets the directory where the CA certificate for the provider
# registrar can be found.
# Use "default" to use 'reg_ca' (this points it to the directory automatically
# created by the registrar if it is set to "generate").
# Use "CV" to use 'cv_ca', the directory automatically created (and shared
# with the registar) by the CV.
registrar_tls_dir = CV

# Set the password needed to decrypt the private key file.
# This should be set to a strong password.
# If you are using the auto generated keys from the CV, set the same password
# here as you did for private_key_pw in the [cloud_verifier] section.
registrar_private_key_pw = default

# Whether registrar validates client certificate
check_client_cert = True

# Database URL Configuration
# See this document https://keylime-docs.readthedocs.io/en/latest/installation.html#database-support
# for instructions on using different database configurations.
# There are two options for the specification of the database connection configuration.
# 1) A tuple of parameters (e.g., database_drivername, database_username, database_password)
# 2) A single string in database_url. This, when set, takes precedence over the previous option.
# An example of database_url value for using sqlite:
#   sqlite:////var/lib/keylime/reg_data.sqlite
# An example of database_url value for using mysql:
#   mysql+pymysql://keylime:keylime@keylime_db:[port]/verifier?charset=utf8
# If database_url is not set, the default is "sqlite", using method 1, and will be
# located at "/var/lib/keylime/cv_data.sqlite".
database_url =
database_drivername = sqlite
database_username = ''
database_password = ''
database_host = ''
database_name = reg_data.sqlite
# Limits for DB connection pool size in sqlalchemy (https://docs.sqlalchemy.org/en/14/core/pooling.html#api-documentation-available-pool-implementations)
database_pool_sz_ovfl=5,10

auto_migrate_db = True


# The file to use for SQLite persistence of provider hypervisor data.
prov_db_filename = provider_reg_data.sqlite

#=============================================================================
[ca]
#=============================================================================

# These options set the metadata that the keylime_ca utility will use when
# creating certificates and CAs.
# These options are also used by the verifier and registrar when using the
# 'tls_dir = generate' option.
# The below options are pretty self-explanatory X509 stuff.
cert_country=US
cert_ca_name=Keylime Certificate Authority
cert_state=MA
cert_locality=Lexington
cert_organization=MITLL
cert_org_unit=53
cert_ca_lifetime=3650
cert_lifetime=365
cert_bits=2048

# This setting allows you to specify where your Certification Revocation List
# (CRL) will be hosted.
# Set to the relevant URL.
# Use "default" to use the tenant machine FQDN as the CRL distribution point.
# WARNING: Use "default" with caution as it will use the result of Python's
# 'socket.getfqdn()' as the hostname. This may not be a properly resolvable
# DNS name in which case you need to specify a hostname where you will
# run the revocation listener (see below).
#
# You can then use keylime_ca -c listen -n ca/RevocationNotifier-cert.crt
cert_crl_dist=http://localhost:38080/crl

# If the provider for certificate generation is "CFSSL", then the HTTP-based
# API server will run at this address and port.
cfssl_ip = 127.0.0.1
cfssl_port = 8888

#=============================================================================
[webapp]
#=============================================================================

# The webapp's IP address and port on which it can be reached.
webapp_ip = 127.0.0.1
webapp_port = 443

# The intervals for populating agents, updating agents and updating terminal.
populate_agents_interval = 4000
update_agents_interval = 1500
update_terminal_interval = 2000

#=============================================================================
# GLOBAL LOGGING CONFIGURATION
#=============================================================================

# The only thing really to change here is the default log levels for either
# console or Keylime loggers.

[loggers]
keys = root,keylime

[handlers]
keys = consoleHandler

[formatters]
keys = formatter

[formatter_formatter]
format = %(asctime)s.%(msecs)03d - %(name)s - %(levelname)s - %(message)s
datefmt = %Y-%m-%d %H:%M:%S

[logger_root]
level = INFO
handlers = consoleHandler

[handler_consoleHandler]
class = StreamHandler
level = INFO
formatter = formatter
args = (sys.stdout,)

[logger_keylime]
level = INFO
qualname = keylime
handlers =