[ca]
default_ca      = CA_default

[CA_default]
dir              = ./ca
crl_dir          = $dir/crl
new_certs_dir    = $dir/newcerts
private_key      = $dir/private/ica.key.pem
database         = $dir/index.txt
crlnumber        = $dir/crlnumber
crl              = $dir/crl.pem
certificate      = $dir/ica.crt.pem
serial           = $dir/serial
x509_extensions  = v3_client
name_opt         = ca_default
cert_opt         = ca_default
default_days     = 3650
default_crl_days = 30
default_md       = default
preserve         = no
policy           = policy_anything
copy_extensions  = copy

[policy_anything]
countryName            = optional
stateOrProvinceName    = optional
localityName           = optional
organizationName       = optional
organizationalUnitName = optional
commonName             = supplied
emailAddress           = optional

[v3_ca]
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints       = critical,CA:true
keyUsage               = cRLSign,keyCertSign

[v3_server]
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid,issuer
basicConstraints       = CA:FALSE
keyUsage               = nonRepudiation,digitalSignature,keyEncipherment
extendedKeyUsage       = serverAuth

[v3_client]
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid,issuer
basicConstraints       = CA:FALSE
keyUsage               = nonRepudiation,digitalSignature,keyEncipherment
extendedKeyUsage       = clientAuth