openssl.cnf

# https://github.com/drduh/config/blob/master/openssl.cnf
# https://github.com/openssl/openssl/blob/master/apps/openssl.cnf
[ req ]
default_bits	    	= 4096
default_md		      = sha512
distinguished_name	= req_distinguished_name
attributes		      = req_attributes
[ req_distinguished_name ]
#countryName			= Country Name (2 letter code)
#countryName_min			= 2
#countryName_max			= 2
#stateOrProvinceName		= State or Province Name (full name)
#localityName			= Locality Name (eg, city)
#0.organizationName		= Organization Name (eg, company)
#organizationalUnitName		= Organizational Unit Name (eg, section)
commonName			= Common Name (eg, fully qualified host name)
commonName_max			= 64
#emailAddress			  = Email Address
#emailAddress_max		= 64
[ req_attributes ]
challengePassword		    = A challenge password
challengePassword_min		= 10
challengePassword_max		= 40
[ ca ]
default_ca = CA_default
[ CA_default ]
dir             = ./demoCA               # Where everything is kept
certs           = $dir/certs             # Where the issued certs are kept
crl_dir         = $dir/crl               # Where the issued crl are kept
database        = $dir/index.txt         # database index file.
new_certs_dir   = $dir/newcerts          # default place for new certs.
certificate     = $dir/cacert.pem        # The CA certificate
serial          = $dir/serial            # The current serial number
crlnumber       = $dir/crlnumber         # the current crl number
crl             = $dir/crl.pem           # The current CRL
private_key     = $dir/private/cakey.pem # The private key
RANDFILE        = $dir/private/.rand     # private random number file
x509_extensions = usr_cert               # The extensions to add to the cert
name_opt        = ca_default             # Subject Name options
cert_opt        = ca_default             # Certificate field options
default_days    = 365                    # how long to certify for
default_crl_days= 30                     # how long before next CRL
default_md      = default                # use public key default MD
preserve        = no                     # keep passed DN ordering
policy          = policy_match
[ policy_match ]
countryName             = optional
stateOrProvinceName     = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional
[ policy_anything ]
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional
[ v3_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = critical,CA:true
[ tls_client ]
basicConstraints = CA:FALSE
nsCertType       = client
keyUsage         = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = clientAuth
[ tls_server ]
basicConstraints     = CA:FALSE
nsCertType           = server
keyUsage             = digitalSignature, keyEncipherment
extendedKeyUsage     = serverAuth
subjectKeyIdentifier = hash