#
# OpenSSL configuration file.
#

# Establish working directory.

dir					= .

[ ca ]
default_ca				= CA_default

[ CA_default ]
serial					= $dir/temp/serial
database				= $dir/temp/index.txt
new_certs_dir				= $dir
certificate				= $dir/cacert.pem
private_key				= $dir/ca_key.pem
default_days				= 3650
default_md				= sha256
preserve				= no
email_in_dn				= no
nameopt					= default_ca
certopt					= default_ca
policy					= policy_match
x509_extensions	                        = openssl_usr_cert     # Default extensions to add to the cert

[ policy_match ]
countryName				= optional
stateOrProvinceName			= optional
organizationName			= optional
organizationalUnitName			= optional
commonName				= supplied
emailAddress				= optional

[ req ]
default_bits				= 2048			# Size of keys
default_keyfile				= key.pem		# name of generated keys
default_md				= sha256		# message digest algorithm
string_mask				= nombstr		# permitted characters
distinguished_name			= req_distinguished_name
#req_extensions				= v3_req                # omit - openssl doesn't copy req extension
x509_extensions	                        = v3_ca                 # The extentions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

[ req_distinguished_name ]
# Variable name				Prompt string
#-------------------------	  ----------------------------------
countryName				= Country Name (2 letter code)
countryName_default			= US
commonName				= Common Name (hostname, IP, or your name)
commonName_max				= 64

#0.organizationName			= Organization Name (company)
#organizationalUnitName			= Organizational Unit Name (department, division)
#emailAddress				= Email Address
#emailAddress_max			= 40
#localityName				= Locality Name (city, district)
#stateOrProvinceName			= State or Province Name (full name)
#countryName_min				= 2
#countryName_max				= 2

# Default values for the above, for consistency and less typing.
# Variable name				Value
#------------------------	  ------------------------------
0.organizationName_default		= My Company
localityName_default			= My Town
stateOrProvinceName_default		= State or Providence

[ v3_usr ]
# Standard openssl extensions on user certificates
# These extensions are added when 'ca' signs a request.
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

[ v3_ca ]
# PKIX-conformant extensions on CA certificates
# PKIX recommendation.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always

# PKIX requires basicConstraints to be critical on CA certs (sec 4.2.1.9)
basicConstraints = critical,CA:true

# PKIX requires keyUsage present with keyCertSign on CA certs (sec 4.2.1.3)
keyUsage = keyCertSign

[ v3_req ]
basicConstraints			= CA:FALSE
subjectKeyIdentifier			= hash
