[ ca ]
default_ca = CA_default

[ CA_default ]
new_certs_dir = .
database = ./index.txt
serial = ./serial
default_md = sha256
policy = policy_min

[ req ]
distinguished_name = def_distinguished_name

[def_distinguished_name]

# Extensions
#   -addext " ... = ..."
#
[ v3_ca ]
   # Extensions for a typical Root CA.
   basicConstraints = critical,CA:TRUE
   keyUsage = critical, digitalSignature, cRLSign, keyCertSign
   subjectKeyIdentifier = hash
   authorityKeyIdentifier = keyid:always,issuer

[ v3_int_ca ]
   # Extensions for a typical intermediate CA.
   basicConstraints = critical, CA:TRUE
   keyUsage = critical, digitalSignature, cRLSign, keyCertSign
   subjectKeyIdentifier = hash
   authorityKeyIdentifier = keyid:always,issuer

[ usr_cert ]
   # Extensions for user end certificates.
   basicConstraints = CA:FALSE
   keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
   extendedKeyUsage = clientAuth, emailProtection
   subjectKeyIdentifier = hash
   authorityKeyIdentifier = keyid,issuer

[ policy_min ]
   countryName		= optional
   stateOrProvinceName	= optional
   localityName		= optional
   organizationName	= optional
   organizationalUnitName = optional
   commonName		= supplied
   emailAddress		= optional