#
# OpenSSL example configuration file.

HOME            = .
#RANDFILE        = $ENV::HOME/.rnd

####################################################################
[ ca ]
default_ca  = CA_default        # The default ca section

[ CA_default ]
default_days		= 365          # how long to certify for
default_crl_days	= 365            # how long before next CRL
default_md			= sha512        # use public key default MD
preserve			= no            # keep passed DN ordering

email_in_dn		= yes            # Don't concat the email in the DN
copy_extensions	= copyall          # Required to copy SANs from CSR to cert
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

dir		= ${ENV::CA_PATH}
new_certs_dir	= $dir/certs
database	= $dir/index.txt
serial		= $dir/serial
certificate	= $dir/ca.crt

x509_extensions	= ca_extensions
policy			= ca_match
unique_subject	= no

[ ca_extensions ]
crlDistributionPoints=URI:http://www.somenet.org/somenet.crl

[ ca_match ]
organizationName	= match
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

####################################################################
[ req ]
default_bits		= 4096
distinguished_name	= req_distinguished_name
string_mask			= utf8only
default_md			= sha512
x509_extensions		= v3_ca
req_extensions		= v3_req

####################################################################
[ req_distinguished_name ]
0.organizationName			= Organization Name (eg, company)
0.organizationName_default	= somenet.org

organizationalUnitName		= Organizational Unit Name (eg, section)
organizationalUnitName_default	= CertGen

commonName					= Common Name (e.g. server FQDN or YOUR name)
commonName_max				= 64

emailAddress				= Email Address
emailAddress_max			= 64

####################################################################
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

####################################################################
[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = CA:true

####################################################################
[ v3_ca_req ]
basicConstraints = CA:true
keyUsage = keyCertSign, cRLSign

####################################################################

# ALT_NAMES MUST BE THE LAST LINE.
[alt_names]