# Simple Root CA

# The [default] section contains global constants that can be referred to from
# the entire configuration file. It may also hold settings pertaining to more
# than one openssl command.

[ default ]
ca                      = {{name}}-ca				# CA name
dir                     = ./config/certificates			# Top dir

# The next part of the configuration file is used by the openssl req command.
# It defines the CA's key pair, its DN, and the desired extensions for the CA
# certificate.

[ req ]
default_bits            = 2048                  # RSA key size
encrypt_key             = yes                   # Protect private key
default_md              = sha256                  # MD to use
utf8                    = yes                   # Input is UTF-8
string_mask             = utf8only              # Emit UTF-8 strings
prompt                  = no                    # Don't prompt for DN
distinguished_name      = ca_dn                 # DN section
x509_extensions         = v3_ca
#req_extensions          = crl_ext		# Desired extensions

[ ca_dn ]
0.domainComponent       = "com"
1.domainComponent       = "{{name}}"
organizationalUnitName  = "{{name}} Root CA"
countryName		= FR
stateOrProvinceName	= BDR
localityName		= Marseille
organizationName	= {{name}} Signing Authority
organizationalUnitName	= Development
emailAddress		= {{authorMail}}
commonName              = "{{domain}}"

[ ca_reqext ]
keyUsage                = critical,keyCertSign,cRLSign
basicConstraints        = critical,CA:true
subjectKeyIdentifier    = hash

# The remainder of the configuration file is used by the openssl ca command.
# The CA section defines the locations of CA assets, as well as the policies
# applying to the CA.

[ ca ]
default_ca              = root_ca			# The default CA section

[ root_ca ]
prompt                  = no
certificate             = $dir/ca/certs/ca.cert.pem	# The CA cert
private_key             = $dir/ca/private/ca.key.pem	# CA private key
new_certs_dir           = $dir/ca/certs			# Certificate archive
serial                  = $dir/ca/db/serial		# Serial number file
crlnumber               = $dir/ca/db/crlnumber		# CRL number file
database                = $dir/ca/db/$ca.db		# Index file

unique_subject          = no				# Require unique subject
default_days            = 3652				# How long to certify for
default_md              = sha256			# MD to use
policy                  = match_pol			# Default naming policy
email_in_dn             = no				# Add email to cert DN
preserve                = no				# Keep passed DN ordering
name_opt                = ca_default			# Subject DN display options
cert_opt                = ca_default			# Certificate display options
copy_extensions         = copy				# Copy extensions from CSR
default_crl_days        = 365				# How long before next CRL
crl_extensions          = crl_ext			# CRL extensions

# Naming policies control which parts of a DN end up in the certificate and
# under what circumstances certification should be denied.

[ match_pol ]
domainComponent         = match				# Must match 'simple.org'
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ any_pol ]
domainComponent         = optional
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ crl_ext ]
# Extension for CRLs (`man x509v3_config`).
authorityKeyIdentifier	=keyid:always

[ v3_ca ]
# Extensions for a typical CA (`man x509v3_config`).
subjectKeyIdentifier	= hash
authorityKeyIdentifier	= keyid:always,issuer
basicConstraints	= critical, CA:true
keyUsage		= critical, digitalSignature, cRLSign, keyCertSign
subjectAltName		= @alt_names

[ v3_intermediate_ca ]
# Extensions for a typical intermediate CA (`man x509v3_config`).
subjectKeyIdentifier	= hash
authorityKeyIdentifier	= keyid:always,issuer
basicConstraints	= critical, CA:true, pathlen:0
keyUsage		= critical, digitalSignature, cRLSign, keyCertSign
subjectAltName		= @alt_names

[ alt_names ]
IP.1			= 127.0.0.1
IP.2			= 0.0.0.0
DNS.1			= localhost
DNS.2			= docker.{{name}}.com
DNS.3			= {{name}}.com

[ usr_cert ]
# Extensions for client certificates (`man x509v3_config`).
basicConstraints	= CA:FALSE
nsCertType		= client, email
nsComment		= "OpenSSL Generated Client Certificate"
subjectKeyIdentifier	= hash
authorityKeyIdentifier	= keyid,issuer
keyUsage		= critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage	= clientAuth, emailProtection
subjectAltName		= @alt_names

[ server_cert ]
# Extensions for server certificates (`man x509v3_config`).
basicConstraints	= CA:FALSE
nsCertType		= server
nsComment		= "OpenSSL Generated Server Certificate"
subjectKeyIdentifier	= hash
authorityKeyIdentifier	= keyid,issuer:always
keyUsage		= critical, digitalSignature, keyEncipherment
extendedKeyUsage	= serverAuth
subjectAltName		= @alt_names


[ ocsp ]
# Extension for OCSP signing certificates (`man ocsp`).
basicConstraints	= CA:FALSE
subjectKeyIdentifier	= hash
authorityKeyIdentifier	= keyid,issuer
keyUsage		= critical, digitalSignature
extendedKeyUsage	= critical, OCSPSigning