ca.conf
******************************************************************************

[root@localhost db]# cat ca.config
[ ca ]
default_ca = CA_CLIENT # use ca_client section as default while sign CSR

[ CA_CLIENT ]
dir = ./ # main direcory
certs = $dir/certs # certificate directory
new_certs_dir = $dir/newcerts # new certificates directory

database = $dir/index.txt # database file that contains signed certificates
serial = $dir/serial # file that contains serial numbers of certificates in hex
certificate = ../ca.crt # CA certificate file
private_key = ../ca.key # CA key file

default_days = 365 # lifetime of signed certificate
default_crl_days = 7 # lifetime of CRL
default_md = md5 # sign method

policy = policy_anything # section to use to describe policies

[ policy_anything ]
countryName = optional # change to 'supplied' if something is important.
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = optional
emailAddress = optional