[ ca ]  
default_ca = CA_default  
 
[ CA_default ]  
dir = /root/ca-intermediaire  
certs = $dir/certs  
crl_dir = $dir/crl  
database = $dir/index.txt 
new_certs_dir = $dir/newcerts 
certificate = $dir/intermediate.cert 
serial = $dir/serial 
crlnumber = $dir/crlnumber 
crl = $dir/crl.cert 
private_key = $dir/private/intermediate.key  
RANDFILE = $dir/private/.rand 
 
default_days = 365 
default_crl_days = 30  
default_md = sha512 
preserve = no 
policy = policy_loose 
 
[ policy_loose ] 
countryName = match  
stateOrProvinceName = supplied 
localityName = supplied  
organizationName = supplied  
organizationalUnitName = optional 
commonName = supplied  
emailAddress = optional  

[ req ]  
default_bits = 4096 
default_md = sha512  
default_keyfile = privkey.pem 
distinguished_name = req_nom_distinct 
x509_extensions = v3_ca_intermediaire 
 
[ req_nom_distinct ]  
countryName = Country Name (2 letter code) 
countryName_default = FR  
stateOrProvinceName = State or Province Name (full name)  
stateOrProvinceName_default = Paca  
localityName = Locality Name (eg, city)  
localityName_default = Marseille  
0.organizationName = Organization Name (eg, company)  
0.organizationName_default = Igensia  
organizationalUnitName = Organizational Unit Name (eg, section)  
organizationalUnitName_default = ISCPA  
commonName = Common Name (eg, your name)  
commonName_max = 64  
emailAddress = Email Address  
emailAddress_max = 64  
 
[ v3_ca_intermediaire ]  
subjectKeyIdentifier = hash  
authorityKeyIdentifier = keyid:always,issuer  
basicConstraints = critical,CA:true,pathlen:0  
keyUsage = critical, cRLSign, keyCertSign  
 
[ server_cert ] 
basicConstraints = CA:FALSE 
nsCertType = server 
subjectKeyIdentifier = hash 
authorityKeyIdentifier = keyid,issuer:always 
keyUsage = critical, digitalSignature, keyEncipherment  
extendedKeyUsage = serverAuth 
subjectAltName = @alt_names  

[ alt_names ]  
DNS.1 = maquette.igensia 

[ crl_ext ]  
authorityKeyIdentifier=keyid:always