# OpenSSL example Certificate Authority configuration file.

####################################################################
[ ca ]
default_ca = CA_default # The default ca section

####################################################################
[ CA_default ]

dir = . # Where everything is kept
certs = $dir/certs_sec # Where the issued certs are kept
new_certs_dir = $dir/certs_sec
crl_dir = $dir/crl_sec # Where the issued crl are kept
database = $dir/index_sec.txt # database index file.

certificate = $dir/seccacert.pem # The CA certificate
serial = $dir/serial_sec # The current serial number
crlnumber = $dir/crlnumber_sec # the current crl number
                               # must be commented out to leave a V1 CRL
crl = $dir/crl_sec.pem # The current CRL
private_key = $dir/seccakey.pem # The private key
RANDFILE = $dir/private/.rand # private random number file

name_opt = ca_default # Subject Name options
cert_opt = ca_default # Certificate field options

default_days = 1825 # how long to certify for
default_crl_days = 365 # how long before next CRL
default_md = sha256 # which md to use.
preserve = no # keep passed DN ordering

policy = policy_match
x509_extensions = local_ca_extensions
#
#
# Copy extensions specified in the certificate request
#
copy_extensions = copy

# For the CA policy
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

#
#
# x509 extensions to use when generating server certificates.
#
[ local_ca_extensions ]
basicConstraints        = CA:false

[ req ]
prompt = no
default_bits    = 2048
#default_keyfile = privkey.pem
distinguished_name = root_ca_distinguished_name
#attributes = req_attributes
x509_extensions         = root_ca_extensions
string_mask = utf8only

[ root_ca_distinguished_name ]
countryName = ES
stateOrProvinceName = MA
localityName = Tres Cantos
organizationName = eProsima
organizationalUnitName  = eProsima
commonName = eProsima Main Test CA
emailAddress = mainca@eprosima.com

[ root_ca_extensions ]
basicConstraints        = CA:true
