ca.cnf

  [ ca ]
  default_ca             = ca_default
  
  [ ca_default ]
  certificate            = ca/root.pem
  private_key            = ca/root.key
  serial                 = ca/ca.srl
  database               = ca/ca.idx
  new_certs_dir          = ca/signed
  default_md             = default
  policy                 = policy_anything
  preserve               = yes
  default_days           = 90
  unique_subject         = no
  
  [ policy_anything ]
  countryName            = optional
  stateOrProvinceName    = optional
  localityName           = optional
  organizationName       = optional
  organizationalUnitName = optional
  commonName             = optional
  emailAddress           = optional
  
  [ cross ]
  basicConstraints       = critical,CA:true
  keyUsage               = critical,cRLSign,keyCertSign
  
  [ codesigning ]
  keyUsage                = digitalSignature
  extendedKeyUsage        = codeSigning