openssl.cnf

# OpenSSL configuration file for friends of frostsnow.net
# This is used for signing of friend's certificate requests.

[ ca ]
default_ca	= ca_default		# The default ca section

[ ca_default ]
# Directory and file locations
dir		= ./			# Where everything is kept
certs		= $dir/certs		# Where the issued certs are kept
crl_dir		= $dir/crl		# Where the issued crl are kept
new_certs_dir	= $dir/newcerts		# default place for new certs.
database	= $dir/index.txt	# database index file.
serial		= $dir/serial 		# The current serial number
RANDFILE	= $dir/private/.rand	# private random number file

# Root key and cert.
private_key	= $dir/private/key.pem  # The private key
certificate	= $dir/certs/cert.pem 	# The CA certificate

# Use better hash.
default_md 	= sha512

name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options
default_days 	= 7200
preserve	= no			# keep passed DN ordering
policy		= policy_anything
x509_extensions	= v3_friend		# The extentions to add to the cert

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

[ v3_friend ]
# Extensions for friends of friends.
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical,CA:false