| [req] |
| encrypt_key = no |
| utf8 = yes |
| string_mask = utf8only |
| prompt = no |
| distinguished_name = req_dn |
| req_extensions = req_ext |
| |
| [req_dn] |
| commonName = "Root" |
| |
| [req_ext] |
| subjectKeyIdentifier = hash |
| keyUsage = critical,keyCertSign,cRLSign |
| basicConstraints = critical,CA:true |
| |
| [ca] |
| default_ca = root_ca |
| |
| [root_ca] |
| certificate = out/Root.pem |
| new_certs_dir = out |
| serial = out/Root.serial |
| database = out/Root.db |
| unique_subject = no |
| default_days = 365 |
| default_md = sha256 |
| policy = policy_anything |
| email_in_dn = no |
| preserve = yes |
| name_opt = multiline,-esc_msb,utf8 |
| cert_opt = ca_default |
| copy_extensions = copy |
| x509_extensions = signing_ca_ext |
| default_crl_days = 30 |
| crl_extensions = crl_ext |
| private_key = keys/Root.key |
| |
| [policy_anything] |
| domainComponent = optional |
| countryName = optional |
| stateOrProvinceName = optional |
| localityName = optional |
| organizationName = optional |
| organizationalUnitName = optional |
| commonName = optional |
| emailAddress = optional |
| |
| [signing_ca_ext] |
| subjectKeyIdentifier = hash |
| authorityKeyIdentifier = keyid:always |
| authorityInfoAccess = @issuer_info |
| crlDistributionPoints = @crl_info |
| |
| [issuer_info] |
| caIssuers;URI.0 = http://url-for-aia/Root.cer |
| |
| [crl_info] |
| URI.0 = http://url-for-crl/Root.crl |
| |
| [crl_ext] |
| authorityKeyIdentifier = keyid:always |
| authorityInfoAccess = @issuer_info |
| |
