root-ca-openssl.conf

#  mkdir -p {certreqs,certs,crl,newcerts,private}
#  touch root-ca.index
#  echo 00 > root-ca.crlnum
#  openssl rand -hex 20 > root-ca.serial

#  OPENSSL_CONF=./root-ca-openssl.conf openssl req -new -sha512 -nodes -out certreqs/root-ca.req.pem
#  OPENSSL_CONF=./root-ca-openssl.conf openssl ca -selfsign -in certreqs/root-ca.req.pem -out certs/root-ca.cert.pem -extensions root-ca_ext

#  OPENSSL_CONF=./root-ca-openssl.conf openssl req -new -sha512 -nodes -newkey rsa:2048 -keyout private/admin.key.pem -out certreqs/admin.req.pem -reqexts admin-cert_req_ext
#  OPENSSL_CONF=./root-ca-openssl.conf openssl ca -days 7300 -in certreqs/admin.req.pem -out certs/admin.cert.pem -extensions admin-cert_ext

#  openssl pkcs12 -export -out private/admin.p12 -inkey private/admin.key.pem -in certs/admin.cert.pem -name "czertainly-admin"
#  password: 00000000

[ ca ]
default_ca              = root_ca

[ root_ca ]
dir                     = .
certs                   = $dir/certs
crl_dir                 = $dir/crl
new_certs_dir           = $dir/newcerts
serial                  = $dir/root-ca.serial
database                = $dir/root-ca.index
keys                    = $dir/keys

certificate             = $dir/certs/root-ca.cert.pem
private_key             = $dir/private/root-ca.key.pem

crl                     = $dir/root-ca.crl
crlnumber               = $dir/root-ca.crlnum
crl_extensions          = crl_ext
default_crl_days        = 180

default_days            = 9125 # 25 years
name_opt                = multiline, align
cert_opt                = no_pubkey
copy_extensions         = copy
default_md              = sha512
preserve                = no
email_in_dn             = no
policy                  = policy
unique_subject          = no

[ policy ]
commonName              = supplied

[ req ]
dir                     = .
default_bits            = 4096
default_keyfile         = $dir/private/root-ca.key.pem
encrypt_key             = yes
default_md              = sha512
string_mask             = utf8only
utf8                    = yes
req_extensions          = root-ca_req_ext
distinguished_name      = distinguished_name

[ root-ca_req_ext ]
subjectKeyIdentifier    = hash

[ distinguished_name ]
commonName                      = Common Name (identification of the Root CA)
commonName_default              = CZERTAINLY Dummy Root CA

[ root-ca_ext ]
basicConstraints        = critical, CA:true
keyUsage                = critical, keyCertSign, cRLSign
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always
certificatePolicies     = @root_policy

[ root_policy ]
policyIdentifier = 2.5.29.32.0
userNotice.1     = @root_policy_notice

[ root_policy_notice ]
explicitText = "UTF8:This is a dummy Root CA for testing purposes"

[ admin-cert_req ]
dir                     = .
default_bits            = 2048
default_keyfile         = $dir/private/admin.key.pem
encrypt_key             = yes
default_md              = sha512
string_mask             = utf8only
utf8                    = yes
req_extensions          = admin-cert_req_ext
distinguished_name      = admin-cert_distinguished_name

[ admin-cert_req_ext ]
subjectKeyIdentifier    = hash

[ admin-cert_distinguished_name ]
commonName                      = Common Name (identification of the Root CA)
commonName_default              = CZERTAINLY Administrator

[ admin-cert_ext ]
basicConstraints        = critical, CA:false
keyUsage                = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage        = clientAuth
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always
certificatePolicies     = @admin-cert_policy

[ admin-cert_policy ]
policyIdentifier = 2.5.29.32.0
userNotice.1 = @admin-cert_policy_notice

[ admin-cert_policy_notice ]
explicitText = "UTF8:This is a dummy administrator certificate for testing purposes"