oid_section             = certes_oids

[certes_oids]
certesRoles             = 1.3.6.1.4.1.64862.3.1

[ca]
default_ca              = root_ca

[root_ca]
certificate             = ca/root.pem
database                = ca/index.txt
new_certs_dir           = ca/certs
private_key             = ca/key.pem
serial                  = ca/serial
default_crl_days        = 365
default_days            = 365
default_md              = sha256
copy_extensions         = copy
policy                  = root_ca_policy
x509_extensions         = root_ext

[root_ca_policy]
commonName              = supplied
stateOrProvinceName     = optional
countryName             = optional
emailAddress            = optional
organizationName        = supplied
organizationalUnitName  = optional
 
[root_ext]
basicConstraints        = critical,CA:true
keyUsage                = critical,cRLSign,digitalSignature,keyCertSign
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer

[intermediate_ca_ext]
basicConstraints        = critical,CA:true,pathlen:0
keyUsage                = critical,cRLSign,digitalSignature,keyCertSign
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid,issuer
certesRoles             = ASN1:SEQUENCE:intermediate_ca_roles

[intermediate_ca_roles]
certesRoles.0           = IA5:agent
certesRoles.1           = IA5:authority
certesRoles.2           = IA5:bootstrap
certesRoles.3           = IA5:certadmin

[intermediate_proxy_crt_ext]
basicConstraints        = critical,CA:false
keyUsage                = critical,keyEncipherment,digitalSignature
extendedKeyUsage        = serverAuth,clientAuth
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid,issuer
certesRoles             = ASN1:SEQUENCE:proxy_roles

[proxy_roles]
certesRoles.0           = IA5:caproxy

[intermediate_client_crt_ext]
basicConstraints        = critical,CA:false
keyUsage                = critical,keyEncipherment,digitalSignature
extendedKeyUsage        = serverAuth,clientAuth
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid,issuer
certesRoles             = ASN1:SEQUENCE:client_roles

[client_roles]
certesRoles.0           = IA5:agent

[req]
default_bits            = 4096
default_md              = sha256
distinguished_name      = dn

[dn]
0.organizationName         = Organization Name (eg, company)
0.organizationName_default = MinMaxiste Inc.
commonName                 = Common Name (eg, fully qualified host name)
commonName_max             = 64
emailAddress               = Email Address
emailAddress_max           = 64
emailAddress_default       = certes@minmaxiste.com
