# OpenSSL Root CA configuration file

# This section is only used for signing Intermediate CA certificates
[ ca ]
default_ca              = CA_default

[ CA_default ]
dir                     = {{ pg.directory }}

database                = {{ pg.database_file }}
new_certs_dir           = {{ pg.new_certificates_directory }}
serial                  = {{ pg.serial_file }}

certificate             = {{ pg.certificate_file }}
private_key             = {{ pg.private_key_file }}

default_md              = sha256

# Allow reissuing certificates to same subject without having to edit the database
unique_subject          = no

# Expect Intermediate CA CSR to provide Common Name and Organization Name
policy                  = policy_default

[ policy_default ]
commonName              = supplied
organizationName        = supplied
organizationalUnitName  = supplied

[ req ]
distinguished_name      = req_distinguished_name
# Don't ask for any user inputs, use values from req_distinguished_name section instead
prompt                  = no
x509_extensions         = v3_ca

[ req_distinguished_name ]
CN                      = {{ pg.common_name }}
O                       = {{ pg.organization }}
OU                      = {{ pg.organizational_unit }}

[ v3_ca ]
# Allow Root CA to act as a CA
basicConstraints        = critical, CA:true
# Allow Root CA to sign certificates
keyUsage                = critical, digitalSignature, keyCertSign
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer

# This sections needs to be activated with `-extensions v3_intermediate_ca` from the CLI
[ v3_intermediate_ca ]
# Allow Intermediate CA to act as a CA but it cannot issue certificates to another CA
basicConstraints        = critical, CA:true, pathlen:0
# Allow Intermediate CA to sign certificates
keyUsage                = critical, digitalSignature, keyCertSign
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer
