openssl.conf

[ ca ]
default_ca = fake_ca
days = 3650

[ fake_ca ]
dir = .
certificate = $dir/ca.crt
database = $dir/index.txt
new_certs_dir = $dir/certs
private_key = $dir/ca.key
x509_extensions = certificate_extensions

default_days   = 365
default_md     = sha256
serial         = serial
policy         = fake_ca_policy
unique_subject = no

email_in_dn     = no
copy_extensions = copy

[ fake_ca_policy ]
commonName           = supplied
emailAddress         = optional
stateOrProvinceName  = optional
localityName         = optional
organizationName     = optional
organizationalUnitName = optional

[ certificate_extensions ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment

[ req ]
default_bits    = 2048
default_keyfile = ca.key
default_md      = sha256
prompt          = yes
string_mask     = utf8only

x509_extensions    = root_ca_extensions
distinguished_name = root_ca_distinguished_name


[ root_ca_distinguished_name ]
countryName            = DE
countryName_default    = DE
organizationName       = Fake AG
organizationalUnitName = Fake IT
commonName             = hostname
emailAddress           = ca@fakeca.local

[ root_ca_extensions ]
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid:hash, issuer
basicConstraints       = critical, CA:true
keyUsage = keyCertSign, cRLSign

[ client_ca_extensions ]
basicConstraints = CA:FALSE
nsCertType = client
keyUsage = digitalSignature
extendedKeyUsage = clientAuth

[ server_ca_extensions ]
basicConstraints = CA:FALSE
nsCertType       = server
keyUsage         = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid,issuer

[ commented_out ]
extendedKeyUsage = serverAuth, 1.3.6.1.5.5.7.3.1
extendedKeyUsage = clientAuth, 1.3.6.1.5.5.7.3.2

[ server_altname_extensions ]
subjectAltName=DNS:host.fakeca.local,DNS:host