# Self Signed (note the addition of -x509):
#     openssl req -config example-com.conf -new -x509 -sha256 -newkey rsa:2048 -nodes -keyout example-com.key.pem -days 365 -out example-com.cert.pem
# Signing Request (note the lack of -x509):
#     openssl req -config example-com.conf -new -newkey rsa:2048 -nodes -keyout example-com.key.pem -days 365 -out example-com.req.pem
# Print it:
#     openssl x509 -in example-com.cert.pem -text -noout
#     openssl req -in example-com.req.pem -text -noout

HOME            = .
RANDFILE        = $ENV::HOME/.rnd

[ req ]
default_bits       = 2048
default_keyfile    = key.pem
distinguished_name = localhost_distinguished_name
req_extensions     = localhost_req_extensions
x509_extensions    = localhost_x509_extensions
string_mask        = utf8only
default_days       = 3650         # How long to certify for
default_md         = sha256       # Use public key default MD
prompt             = no

base_dir      = .
serial        = $base_dir/serial.txt   # The current serial number

# The Subject DN can be formed using X501 or RFC 4514 (see RFC 4519 for a description).
#   It's sort of a mashup. For example, RFC 4514 does not provide emailAddress.
[ localhost_distinguished_name ]
countryName          = DE
stateOrProvinceName  = Baden-Wuerttemberg
localityName         = Sindelfingen
organizationName     = innovaphone AG
organizationalUnitName = Development Department

# Use a friendly name here because it's presented to the user. The server's DNS
#   names are placed in Subject Alternate Names. Plus, DNS names here is deprecated
#   by both IETF and CA/Browser Forums. If you place a DNS name here, then you 
#   must include the DNS name in the SAN too (otherwise, Chrome and others that
#   strictly follow the CA/Browser Baseline Requirements will fail).
commonName           = localhost
emailAddress         = info@innovaphone.com

# Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
[ localhost_x509_extensions ]

subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid,issuer

#  If RSA Key Transport bothers you, then remove keyEncipherment. TLS 1.3 is removing RSA
#  Key Transport in favor of exchanges with Forward Secrecy, like DHE and ECDHE.
basicConstraints        = CA:TRUE
keyUsage                = digitalSignature, keyEncipherment, keyCertSign
subjectAltName          = @alternate_names
nsComment               = "OpenSSL Generated Certificate"

# RFC 5280, Section 4.2.1.12 makes EKU optional
# CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused
# extendedKeyUsage  = serverAuth, clientAuth

# Section req_ext is used when generating a certificate signing request. I.e., openssl req ...
[ localhost_req_extensions ]

subjectKeyIdentifier    = hash

basicConstraints        = CA:FALSE
keyUsage                = digitalSignature, keyEncipherment
subjectAltName          = @alternate_names
nsComment               = "OpenSSL Generated Certificate"

# RFC 5280, Section 4.2.1.12 makes EKU optional
# CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused
# extendedKeyUsage  = serverAuth, clientAuth

[ signing_policy ]
countryName            = optional
stateOrProvinceName    = optional
localityName           = optional
organizationName       = optional
organizationalUnitName = optional
commonName             = supplied
emailAddress           = optional

[ policy_match ]
organizationName = match

[ alternate_names ]

DNS.1    = localhost

# IPv4 localhost
IP.1     = 127.0.0.1

# IPv6 localhost
IP.2     = ::1
