# OpenSSL Intermediate CA configuration file

[ ca ]
default_ca              = CA_default

[ CA_default ]
dir                     = {{ pg.directory }}

database                = {{ pg.database_file }}
new_certs_dir           = {{ pg.new_certificates_directory }}
serial                  = {{ pg.serial_file }}

certificate             = {{ pg.certificate_file }}
private_key             = {{ pg.private_key_file }}

default_md              = sha256
default_days            = 30

# This is to support CSRs that include a Subject Alternative Name
# SANs aren't used by OpenSSL by default
# Chrome has dropped support for certificates without SANs
# This has some downsides as well, but, we trust all the CSR's sent our way
copy_extensions         = copy
unique_subject          = no

policy                  = policy_default

[ policy_default ]
commonName              = supplied
organizationName        = supplied
organizationalUnitName  = supplied

[ req ]
distinguished_name      = req_distinguished_name
prompt                  = no

[ req_distinguished_name ]
CN                      = {{ pg.name }}
O                       = {{ pg.organization }}
OU                      = {{ pg.organizational_unit }}

[ server_cert ]
# The Server certificate can't act as a CA
basicConstraints        = CA:FALSE
# The Server certificate can't be used to sign any certificates
keyUsage                = critical, digitalSignature, keyEncipherment
extendedKeyUsage        = serverAuth
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid,issuer:always
nsCertType              = server
nsComment               = "OpenSSL Generated Server Certificate"
