[ca] default_ca = CA_default [CA_default] dir = ./ca crl_dir = $dir/crl new_certs_dir = $dir/newcerts private_key = $dir/private/ica.key.pem database = $dir/index.txt crlnumber = $dir/crlnumber crl = $dir/crl.pem certificate = $dir/ica.crt.pem serial = $dir/serial x509_extensions = v3_client name_opt = ca_default cert_opt = ca_default default_days = 3650 default_crl_days = 30 default_md = default preserve = no policy = policy_anything copy_extensions = copy [policy_anything] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [v3_ca] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer basicConstraints = critical,CA:true keyUsage = cRLSign,keyCertSign [v3_server] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer basicConstraints = CA:FALSE keyUsage = nonRepudiation,digitalSignature,keyEncipherment extendedKeyUsage = serverAuth [v3_client] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer basicConstraints = CA:FALSE keyUsage = nonRepudiation,digitalSignature,keyEncipherment extendedKeyUsage = clientAuth