config_diagnostics = 1

####################################################################
[ ca ]
default_ca	= Zi3_CA
[ Zi3_CA ]
dir		= $ENV::CA_DIR		# Where everything is kept
new_certs_dir	= $dir/certs		# default place for new certs.
certs		= $dir/certs		# Where the issued certs are kept
crl_dir		= $dir/db/crl		# Where the issued crl are kept
crlnumber	= $crl_dir/number	# the current crl number
crl		= $dir/db/crl/crl.pem	# The current CRL
database	= $dir/db/index.txt	# database index file.
serial		= $dir/db/serial 	# The current serial number
certificate	= $dir/ca.pem	 	# The CA certificate
private_key	= $dir/keys/ca.key	# The private key
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options
default_days	= 1825			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= default		# use public key default MD
preserve	= no			# keep passed DN ordering
x509_extensions	= usr_cert		# The extensions to add to the cert
crl_extensions	= crl_ext		# The extensiont to add to CRL certs
policy		= policy_root		# CA must match everything, must supply email

[ policy_root ]
organizationName	= match
organizationalUnitName	= match
commonName		= supplied
emailAddress		= supplied

[ policy_inter ]
organizationName	= match
organizationalUnitName	= supplied
commonName		= supplied
emailAddress		= optional

[ policy_req ]
organizationName	= match
organizationalUnitName	= match
commonName		= supplied
emailAddress		= optional

[ v3_ca ]
subjectKeyIdentifier	= hash
authorityKeyIdentifier	= keyid:always, issuer
basicConstraints	= critical, CA:true
keyUsage		= cRLSign, keyCertSign
subjectAltName		= email:copy

[ v3_intermediate_ca ]
subjectKeyIdentifier	= hash
authorityKeyIdentifier	= keyid:always,issuer
basicConstraints	= critical, CA:true, pathlen:0
keyUsage		= critical, digitalSignature, cRLSign, keyCertSign
subjectAltName		= email:copy

[ v3_req ]
basicConstraints	= CA:FALSE
keyUsage 		= nonRepudiation, digitalSignature, keyEncipherment

[ crl_ext ]
authorityKeyIdentifier	= keyid:always

[ usr_cert ]
basicConstraints	= CA:FALSE
#extendedKeyUsage	= critical, timeStamping
subjectKeyIdentifier	= hash
authorityKeyIdentifier	= keyid:always,issuer
issuerAltName		= issuer:copy
subjectAltName	 	= email:move

####################################################################
[ req ]
default_bits		= 4096
default_keyfile 	= key.pem
distinguished_name	= req_distinguished_name
#attributes		= req_attributes
x509_extensions		= v3_ca
string_mask		= utf8only

[ req_distinguished_name ]
0.organizationName		= Organization
0.organizationName_default	= Zi3
organizationalUnitName		= Service
organizationalUnitName_default	= Testing
commonName			= Common Name (e.g. server FQDN or YOUR name)
commonName_max			= 64
emailAddress			= Email Address
emailAddress_max		= 64