rootca.cnf

#
# OpenSSL configuration for the Root Certification Authority.
#

#
# This definition doesn't work if HOME isn't defined.
CA_HOME                 = /opt/rootca
RANDFILE                = $ENV::CA_HOME/private/.rnd

#
# Default Certification Authority
[ ca ]
default_ca              = root_ca

#
# Root Certification Authority
[ root_ca ]
dir                     = $ENV::CA_HOME
certs                   = $dir/certs
serial                  = $dir/root-ca.serial
database                = $dir/root-ca.index
new_certs_dir           = $dir/newcerts
certificate             = $dir/root-ca.cert.pem
private_key             = $dir/private/root-ca.key.pem
default_days            = 1826 # 5 years
crl                     = $dir/root-ca.crl
crl_dir                 = $dir/crl
crlnumber               = $dir/root-ca.crlnum
name_opt                = multiline, align
cert_opt                = no_pubkey
copy_extensions         = copy
crl_extensions          = crl_ext
default_crl_days        = 180
default_md              = sha384
preserve                = no
email_in_dn             = no
policy                  = policy
unique_subject          = no
x509_extensions         = usr_cert   # The extensions to add to the cert

#
# Distinguished Name Policy for CAs
[ policy ]
countryName             = supplied
stateOrProvinceName     = optional
localityName            = supplied
organizationName        = supplied
organizationalUnitName  = optional
commonName              = supplied

#
# Root CA Request Options
[ req ]
default_bits            = 4096
default_keyfile         = private/root-ca.key.pem
encrypt_key             = yes
default_md              = sha384
string_mask             = utf8only
utf8                    = yes
prompt                  = yes
req_extensions          = root-ca_req_ext
distinguished_name      = distinguished_name
subjectAltName          = @subject_alt_name

#
# Root CA Request Extensions
[ root-ca_req_ext ]
subjectKeyIdentifier    = hash
subjectAltName          = @subject_alt_name

#
# Distinguished Name (DN)
[ distinguished_name ]
organizationName        =blausee.eu
commonName              =Blausee.eu Root Certification Authority

countryName			        = Country Name (2 letter code)
countryName_default     = DE
countryName_min         = 2
countryName_max         = 2

commonName              = Common Name (e.g. server FQDN or YOUR name)
commonName_max          = 64

stateOrProvinceName		  = State or Province Name (full name)
stateOrProvinceName_default	=Hessen

localityName			     = Locality Name (eg, city)

0.organizationName		 = Organization Name (eg, company)
0.organizationName_default	=Blausee

#
# Root CA Certificate Extensions
[ root-ca_ext ]
basicConstraints        = critical, CA:true
keyUsage                = critical, keyCertSign, cRLSign
subjectKeyIdentifier    = hash
subjectAltName          = @subject_alt_name
authorityKeyIdentifier  = keyid:always
issuerAltName           = issuer:copy


#
# CRL Certificate Extensions
[ crl_ext ]
authorityKeyIdentifier  = keyid:always
issuerAltName           = issuer:copy

#
# Certificate Authorities Alternative Names
[ subject_alt_name ]
URI                     = http://blausee.eu/
email                   = s.butzek@gmx.de

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

#
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE

# This will be displayed in Netscape's comment listbox.
nsComment                       = "OpenSSL Generated Certificate"

#
# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

[ user_ext ]
keyUsage                = critical, digitalSignature
extendedKeyUsage        = critical, clientAuth, emailProtection
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always
issuerAltName           = issuer:copy


#
# Certificate download addresses for the root CA
[ auth_info_access ]
#caIssuers;URI           = http://ca.example.net/certs/example.net_Root_Certification_Authority.cert.pem

#
# CRL Download address for the root CA
[ crl_dist ]
#fullname                = URI:http://ca.example.net/crl/example.net_Root_Certification_Authority.crl

# EOF