text: 
  [ ca ]
  default_ca = CA_default
  
  [ CA_default ]
  # Directory and file locations.
  dir               = ./PKI/
  certs             = $dir/certs
  crl_dir           = $dir/crl
  new_certs_dir     = $dir/certs
  database          = $dir/index.txt
  serial            = $dir/serial
  RANDFILE          = $dir/private/.rand
  
  # The root key and root certificate.
  private_key       = $dir/private/ca.key.pem
  certificate       = $dir/certs/ca.cert.pem
  
  # For certificate revocation lists.
  crlnumber         = $dir/crlnumber
  crl               = $dir/crl/ca.crl.pem
  crl_extensions    = crl_ext
  default_crl_days  = 30
  
  # SHA-1 is deprecated, so use SHA-2 instead.
  default_md        = sha256
  
  name_opt          = ca_default
  cert_opt          = ca_default
  default_days      = 730
  preserve          = no
  policy            = policy_loose
  
  [ policy_loose ]
  countryName             = optional
  stateOrProvinceName     = optional
  localityName            = optional
  organizationName        = optional
  organizationalUnitName  = optional
  commonName              = supplied
  emailAddress            = optional
  
  [ req ]
  # Options for the `req` tool (`man req`).
  default_bits        = 2048
  distinguished_name  = req_distinguished_name
  string_mask         = utf8only
  
  # SHA-1 is deprecated, so use SHA-2 instead.
  default_md          = sha256
  
  # Extension to add when the -x509 option is used.
  x509_extensions     = v3_ca
  
  [ req_distinguished_name ]
  # See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
  countryName                     = Country Name (2 letter code)
  stateOrProvinceName             = State or Province Name
  localityName                    = Locality Name
  0.organizationName              = Organization Name
  organizationalUnitName          = Organizational Unit Name
  commonName                      = Common Name
  emailAddress                    = Email Address
  
  # Optionally, specify some defaults.
  countryName_default             = 
  stateOrProvinceName_default     = 
  localityName_default            =
  0.organizationName_default      = 
  organizationalUnitName_default  =
  emailAddress_default            =
  
  [ v3_ca ]
  # Extensions for a typical CA (`man x509v3_config`).
  subjectKeyIdentifier = hash
  authorityKeyIdentifier = keyid:always,issuer
  basicConstraints = critical, CA:true, pathlen:1
  keyUsage = critical, digitalSignature, cRLSign, keyCertSign
  
  [ card_cert ]
  # Extensions for client certificates (`man x509v3_config`).
  basicConstraints = CA:FALSE
  nsCertType = client
  subjectKeyIdentifier = hash
  authorityKeyIdentifier = keyid,issuer
  keyUsage = critical, nonRepudiation
  
  [ crl_ext ]
  # Extension for CRLs (`man x509v3_config`).
  authorityKeyIdentifier=keyid:always
  
  