root_cert.config

[ca]
default_ca = CA

[CA]
dir             = .
certs           = $dir
crldir          = $dir
new_certs_dir   = $certs
database        = $dir/index
certificate     = $certs/root_cert.pem
private_key     = $dir/root_private_key.pem
crl             = $crldir/crl.pem
serial          = $dir/serial.txt
RANDFILE        = $dir/.rand

name_opt        = ca_default
cert_opt        = ca_default
default_days    = 30
default_md      = sha256
unique_subject  = no
copy_extensions = copy
policy          = simple_policy
x509_extensions = x509_ext

[simple_policy]
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = optional
domainComponent         = optional
emailAddress            = optional
name                    = optional
surname                 = optional
givenName               = optional
dnQualifier             = optional

[x509_ext]
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always
basicConstraints        = critical, CA:TRUE
keyUsage = critical, keyCertSign, cRLSign, digitalSignature