OpenSSL configuration file to generate a root certificate for signing client and web server certificates.

make_root_CA.conf

[ req ]
default_keyfile                 = ./root_CA.key
default_md                      = sha1
distinguished_name              = req_distinguished_name
x509_extensions                 = v3_ca
string_mask                     = nombstr
req_extensions                  = v3_req
[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
countryName_default             = CA
countryName_min                 = 2
countryName_max                 = 2
stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = Ontario
localityName                    = Locality Name (eg, city)
localityName_default            = Toronto
0.organizationName              = Organization Name (eg, company)
0.organizationName_default      = Company
organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default  = Certification Services
commonName                      = Root CA Common Name
commonName_default              = Company Root CA
commonName_max                  = 64
[ ca_Default ]
default_md                      = sha1
private_key                     = ./root_CA.key
[ v3_ca ]
basicConstraints                = critical,CA:true
keyUsage                        = cRLSign,keyCertSign
nsCertType                      = objCA
nsCaPolicyUrl                   = http://example.com/ca-policy/
subjectKeyIdentifier            = hash
[ v3_req ]
nsCertType                      = emailCA,sslCA,objCA,objsign