Schema for :ref:`server-plugins-generators-cfg-ssl-certificates` ``sslcert.xml`` An **SSLCACertGroupType** is a tag used to provide logic. Child entries of an SSLCACertGroupType tag only apply to machines that match the condition specified -- either membership in a group, or a matching client name. :xml:attribute:`SSLCACertGroupType:negate` can be set to negate the sense of the match. The name of the client or group to match on. Child entries will only apply to this client or group (unless :xml:attribute:`SSLCACertGroupType:negate` is set). Negate the sense of the match, so that child entries only apply to a client if it is not a member of the given group or does not have the given name. Available certificate formats Explicitly specify subject alternative names for the generated certificate. The full path to the key entry to use for this certificate. This is the *client* path; e.g., for a key defined at ``/var/lib/bcfg2/SSLCA/etc/pki/tls/private/foo.key/sslkey.xml``, **key** should be ``/etc/pki/tls/private/foo.key``. The certificate format to produce. The name of the CA (from :ref:`bcfg2.conf <server-plugins-generators-cfg-configuration>`) to use to generate this certificate. Time (in days) the certificate will be valid for. Override the country set in the CA config Override the location set in the CA config Override the state set in the CA config Override the organizational unit set in the CA config Override the organization set in the CA config Override the email address set in the CA config Append the CA chain certificate to the generated certificate (e.g., to produce a certificate in the format required by Nginx.) Top-level tag for describing an SSLCA generated certificate. Override the global lax_decryption setting in ``bcfg2.conf``.