| [ ca ] | |
| default_ca = CA_default | |
| [ CA_default ] | |
| new_certs_dir = . | |
| database = ./index.txt | |
| serial = ./serial | |
| default_md = sha256 | |
| policy = policy_min | |
| [ req ] | |
| distinguished_name = def_distinguished_name | |
| [def_distinguished_name] | |
| # Extensions | |
| # -addext " ... = ..." | |
| # | |
| [ v3_ca ] | |
| # Extensions for a typical Root CA. | |
| basicConstraints = critical,CA:TRUE | |
| keyUsage = critical, digitalSignature, cRLSign, keyCertSign | |
| subjectKeyIdentifier = hash | |
| authorityKeyIdentifier = keyid:always,issuer | |
| [ v3_int_ca ] | |
| # Extensions for a typical intermediate CA. | |
| basicConstraints = critical, CA:TRUE | |
| keyUsage = critical, digitalSignature, cRLSign, keyCertSign | |
| subjectKeyIdentifier = hash | |
| authorityKeyIdentifier = keyid:always,issuer | |
| [ usr_cert ] | |
| # Extensions for user end certificates. | |
| basicConstraints = CA:FALSE | |
| keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment | |
| extendedKeyUsage = clientAuth, emailProtection | |
| subjectKeyIdentifier = hash | |
| authorityKeyIdentifier = keyid,issuer | |
| [ policy_min ] | |
| countryName = optional | |
| stateOrProvinceName = optional | |
| localityName = optional | |
| organizationName = optional | |
| organizationalUnitName = optional | |
| commonName = supplied | |
| emailAddress = optional |