[ca]

default_ca = user

[usr]
database	= index.txt
serial		= serial
x509_extensions = usr_cert
default_md=sha1
policy		= policy_match
certs		= .

[ocsp]
database	= index.txt
serial		= serial
x509_extensions = ocsp_cert
default_md=sha1
policy		= policy_match
certs		= .

[usr_ke]
database	= index.txt
serial		= serial
x509_extensions = usr_cert_ke
default_md=sha1
policy		= policy_match
certs		= .

[usr_ds]
database	= index.txt
serial		= serial
x509_extensions = usr_cert_ds
default_md=sha1
policy		= policy_match
certs		= .

[subca]
database	= index.txt
serial		= serial
x509_extensions = v3_ca
default_md=sha1
policy		= policy_match
certs		= .


[ req ]
distinguished_name	= req_distinguished_name
x509_extensions		= v3_ca	# The extentions to add to the self signed cert

string_mask = utf8only

[ v3_ca ]

subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
basicConstraints = CA:true
keyUsage = cRLSign, keyCertSign, keyEncipherment, nonRepudiation, digitalSignature

[ usr_cert ]
basicConstraints=CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectKeyIdentifier	= hash

[ usr_cert_ke ]
basicConstraints=CA:FALSE
keyUsage = nonRepudiation, keyEncipherment
subjectKeyIdentifier	= hash

[ proxy_cert ]
basicConstraints=CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectKeyIdentifier	= hash
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:1,policy:text:foo

[ proxy10_cert ]
basicConstraints=CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectKeyIdentifier	= hash
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:10,policy:text:foo

[ usr_cert_ds ]
basicConstraints=CA:FALSE
keyUsage = nonRepudiation, digitalSignature
subjectKeyIdentifier	= hash

[ ocsp_cert ]
basicConstraints=CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
# ocsp-nocheck and kp-OCSPSigning
extendedKeyUsage	= 1.3.6.1.5.5.7.48.1.5, 1.3.6.1.5.5.7.3.9
subjectKeyIdentifier	= hash

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= SE
countryName_min			= 2
countryName_max			= 2

organizationalName		= Organizational Unit Name (eg, section)

commonName			= Common Name (eg, YOUR name)
commonName_max			= 64

#[ req_attributes ]
#challengePassword              = A challenge password
#challengePassword_min          = 4
#challengePassword_max          = 20

[ policy_match ]
countryName		= match
commonName		= supplied