/etc/ca/openssl.cnf (3)

# ------------------------------------------------------------------------------
# openssl.cnf
# ===========
#
# Project   Mini CA
# Scope     Native
# Copyright (C) 2024 by RaySoft, Zurich, Switzerland
# License   GNU General Public License (GPL) 2.0
#           https://www.gnu.org/licenses/gpl2.txt
#
# ------------------------------------------------------------------------------

CA_CTRY=''
CA_LOC=''
CA_ORG=''

ca_path=''
cert_sans=''


[ ca ]
default_ca                = CA_default


[ CA_default ]
dir                       = ${ENV::ca_path}
certs                     = ${dir}/certs
new_certs_dir             = ${dir}/newcerts

statusdir                 = ${dir}/status
database                  = ${statusdir}/index
serial                    = ${statusdir}/serial
RANDFILE                  = ${statusdir}/rand

crldir                    = ${dir}/crl
crlnumber                 = ${crldir}/crlnumber
crl                       = ${crldir}/ca.crl.pem
default_crl_days          = 365

certificate               = ${dir}/certs/ca.cert.pem
private_key               = ${dir}/private/ca.key.pem

default_days              = 365
default_md                = sha256

copy_extensions           = copy

unique_subject            = yes
preserve                  = no
policy                    = policy

name_opt                  = ca_default
cert_opt                  = ca_default


[ policy ]
countryName               = match
stateOrProvinceName       = optional
localityName              = match
organizationName          = match
organizationalUnitName    = optional
commonName                = supplied
emailAddress              = optional


[ req ]
default_md                = sha256
encrypt_key               = yes

preserve                  = no

string_mask               = utf8only
utf8                      = yes

distinguished_name        = req_distinguished_name

copy_extensions           = copy


[ req_distinguished_name ]
countryName               = Country Name (2 letter code)
stateOrProvinceName       = State or Province Name
localityName              = Locality Name
organizationName          = Organization Name
organizationalUnitName    = Organizational Unit Name
commonName                = Common Name
emailAddress              = Email Address

countryName_default       = ${ENV::CA_CTRY}
localityName_default      = ${ENV::CA_LOC}
organizationName_default  = ${ENV::CA_ORG}


[ v3_ca ]
basicConstraints          = critical, CA:true
keyUsage                  = critical, digitalSignature, cRLSign, keyCertSign
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always


[ server_cert ]
basicConstraints          = critical, CA:FALSE
keyUsage                  = critical, digitalSignature, keyEncipherment
extendedKeyUsage          = critical, serverAuth
subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid:always, issuer:always
subjectAltName            = ${ENV::cert_sans}

# ------------------------------------------------------------------------------

Usage

See ca-tools.sh