########################################################################
# Fichier de configuration d'OpenSSL
########################################################################

# Fichier de configuration d'OpenSSL pour la génération d'une requête de
# certificat au format PKCS#10.
#
HOME			= .
RANDFILE		= /etc/ssl/.rand


####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

[ CA_default ]
dir			= /etc/ssl
certs			= $dir/certs
crl_dir			= $dir/crl
database		= $dir/index.txt
new_certs_dir		= $dir/newcerts
certificate		= $dir/certs/ca_local.crt
serial			= $dir/serial
#crl			= $dir/ca.crl
private_key		= $dir/private/ca.key
default_days		= %%ssl_default_cert_time
default_md		= sha256
preserve		= no
unique_subject          = no
x509_extensions		= SERVEUR
copy_extensions		= copy
policy			= policy_anything
email_in_dn    = no
name_opt       = ca_default
cert_opt       = ca_default

[ policy_anything ]
countryName		= supplied
stateOrProvinceName	= optional
localityName		= optional
organizationName	= supplied
organizationalUnitName	= supplied
commonName		= supplied
emailAddress		= optional

[ req ]
default_bits		= %%ssl_default_key_bits
#default_keyfile 	= /tmp/privkey.pem
default_days		= %%ssl_default_cert_time
distinguished_name	= req_distinguished_name
x509_extensions         = SERVEUR
req_extensions          = SERVEUR
string_mask		= nombstr
default_md		= sha256
input_password		= secret
output_password		= secret
prompt			= no

[ req_distinguished_name ]
##countryName			= Country Name (2 letter code)
countryName			= %%ssl_country_name

##organizationName		= Organization Name (eg, company)
organizationName		= %%ssl_organization_name

%def debut_dom(chaine)
    %if chaine.count('.') == 0
	%return chaine
    %else
        %return '.'.join(chaine.split('.')[0:-1])
    %end if
%end def
## OrganizationUnitName
%for %%ssl_ou in %%range(%%len(%%ssl_organization_unit_name))
%if %%ssl_ou != ['']
%%ssl_ou%slurp
.organizationalUnitName        = %%debut_dom(%%ssl_organization_unit_name[%%ssl_ou])
%end if
%end for
##CommonName
commonName			= %%ssl_server_name

[SERVEUR]
basicConstraints        = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage      = serverAuth, clientAuth
nsCertType              = server
nsComment               = " "
%if not %%is_empty(%%ssl_subjectaltname)
subjectAltName          = @ALIASES

[ALIASES]
%set %%idx_dn = 0
%set %%set_ssl_subjectaltname = %%set(%%ssl_subjectaltname)
%for %%altname in %%set_ssl_subjectaltname
DNS.%%idx_dn                   = %%altname
%set idx_dn += 1
%end for

%end if
