[req]
default_bits		= 2048
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_self	# The extentions to add to the self signed cert
utf8=yes

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options. 
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only
#string_mask = pkix

req_extensions = v3_req # The extensions to add to a certificate request

[req_distinguished_name]
# убрал значения для организации, долго выдумывать тестовые

SET-ex3				= SET extension number 3

[req_attributes]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

unstructuredName		= An optional company name

# include a prompt for alternative names...
subjectAltName = Alternative DNS names (comma seperated list)
subjectAltName_default = DNS:myhost.com.au

[v3_req]
# Extensions to add to a certificate request when issue
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement, dataEncipherment

# короткая и длинная форма указания SAN
subjectAltName = DNS:a.res-nsdi.ru, DNS:b.res-nsdi.ru, IP:195.208.4.1
#subjectAltName = @alt_names
subjectKeyIdentifier=hash

extendedKeyUsage= nsSGC, serverAuth, clientAuth

[alt_names]
DNS.1   = a.res-nsdi.ru
IP.1	= 195.208.4.1

[v3_self]
# это будет использоваться как (2) в самоподписанном сертификате
basicConstraints = critical,CA:true,pathlen:0 #invalidate subordinate CA

# Key usage: this (cRLSign, keyCertSign) is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
keyUsage = critical, nonRepudiation, digitalSignature

subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always

[ca]
default_ca	= CA_default		# The default ca section

####################################################################
[CA_default]

dir		= ./demoCA		# Where everything is kept
certs		= $dir/certs		# Where the issued certs are kept
crl_dir		= $dir/crl		# Where the issued crl are kept
database	= $dir/index.txt	# database index file.
#unique_subject	= no			# Set to 'no' to allow creation of
					# several certificates with same subject.
new_certs_dir	= $dir/newcerts		# default place for new certs.

certificate	= $dir/cacert.pem 	# The CA certificate
serial		= $dir/serial 		# The current serial number
crlnumber	= $dir/crlnumber	# the current crl number
					# must be commented out to leave a V1 CRL
crl		= $dir/crl.pem 		# The current CRL
private_key	= $dir/private/cakey.pem# The private key
RANDFILE	= $dir/private/.rand	# private random number file

x509_extensions	= usr_cert		# The extentions to add to the cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

# Extension copying option: use with caution.
# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions	= crl_ext

default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= default		# use public key default MD
preserve	= no			# keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_match

# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
emailAddress		= optional
street			= optional
InnNumberOrg		= optional
OgrnNumberOrg		= optional
commonName		= supplied

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
emailAddress		= optional
street			= optional
InnNumberOrg		= optional
OgrnNumberOrg		= optional
commonName		= supplied

[usr_cert]
# это будет использоваться как (2) в УЦ
# Extensions to add to a certificate request when issue
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement, dataEncipherment

subjectAltName = DNS:example.ru
subjectKeyIdentifier=hash

extendedKeyUsage		= nsSGC, serverAuth, clientAuth, 1.3.6.1.4.1.311.54.1.2 # rdpAuth
certificatePolicies		= serverAuth, clientAuth, 1.3.6.1.4.1.311.54.1.2
# TemplateInfo = RDPServerCert
1.3.6.1.4.1.311.21.7		= DER:30:2E:06:26:2B:06:01:04:01:82:37:15:08:82:F4:F2:4E:85:E5:F8:6C:87:8D:87:27:84:82:EF:6D:81:E0:87:6F:25:84:AA:BF:4C:83:DA:96:48:02:01:64:02:01:05

# only valid when issue certificate
# следующие строки допустимы в (2), но не в (1)
authorityKeyIdentifier=keyid:always,issuer:always
authorityInfoAccess=caIssuers;URI:http://s.example.ru/ca.crt,URI:http://s2.example.ru/ca.crt
#authorityInfoAccess=OCSP;URI:http://s.example.ru/ocsp.php
crlDistributionPoints=URI:http://s.example.ru/ca.crl,URI:http://s2.example.ru/ca.crl