[ca]
default_ca = CA_default

[CA_default]
dir = ./
database = $dir/index.txt
new_certs_dir = ./
serial = $dir/serial
private_key = ./rootca.key
certificate = ./rootca.crt
default_days = 3650
default_md = sha256
policy = policy_anything
copy_extensions = copy
# don't make subjects unique, as we generate two certificates using the same subject line
unique_subject    = no

[policy_anything]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

[ req ]
default_bits       = 2048
distinguished_name = req_distinguished_name
req_extensions    = v3_req

[ req_distinguished_name ]
countryName                        = Country Name (2 letter code)
countryName_default                = US
stateOrProvinceName                = State or Province Name (full name)
stateOrProvinceName_default        = CO
localityName                       = Locality Name (eg, city)
localityName_default               = Boulder
organizationName                   = Organization Name (eg, company)
organizationName_default           = Helm
commonName                         = Common Name (e.g. server FQDN or YOUR name)
commonName_default                 = helm.sh

[ v3_req ]

# [alternate_names]
# This is now set in generate.sh as we want to generate two certs from this config
# using different alternate_names