An anonymized version of the configuration file I often use with OpenSSL

openssl_sample_config.cnf

# OpenSSL root CA configuration file.

[ ca ]
# `man ca`
default_ca              = ICA_default

[ CA_default ]
# Directory and file locations.
dir                     = ./ca                      # Where everything is kept
certs                   = $dir/certs                # Where the issued certs are kept
crl_dir                 = $dir/crl                  # Where the issued crl are kept
new_certs_dir           = $dir/new_certs            # default place for new certs.
database                = $dir/index.txt            # database index file.
serial                  = $dir/serial               # The current serial number
RANDFILE                = $dir/private/.rand

# The root key and root certificate.
private_key             = $dir/private/main-ca.key  # The private key
certificate             = $dir/certs/main-ca.crt        # The CA certificate

# For certificate revocation lists.
crlnumber               = $dir/crlnumber                # the current crl number (comment out for V1)
crl                     = $dir/crl/main-ca.crl.pem  # The current CRL
crl_extensions          = crl_ext                       # Extensions to add to a CRL (comment out for V1)
default_crl_days        = 30                            # how long before next CRL

# SHA-1 is deprecated, so use SHA-2 instead.
default_md              = sha256                    # use public key default MD

name_opt                = ca_default                # Subject Name options
cert_opt                = ca_default                # Certificate field options
default_days            = 7300                      # how long to certify for
preserve                = no                        # keep passed DN ordering
policy                  = policy_strict

[ ICA_default ]
# Directory and file locations.
dir                     = ./ca/intermediate         # Where everything is kept
certs                   = $dir/certs                # Where the issued certs are kept
crl_dir                 = $dir/crl                  # Where the issued crl are kept
new_certs_dir           = $dir/new_certs            # default place for new certs.
database                = $dir/index.txt            # database index file.
serial                  = $dir/serial               # The current serial number
RANDFILE                = $dir/private/.rand

# The root key and root certificate.
private_key             = $dir/private/main-ica.key # The private key
certificate             = $dir/certs/main-ica.crt   # The CA certificate

# For certificate revocation lists.
crlnumber               = $dir/crlnumber                # the current crl number (comment out for V1)
crl                     = $dir/crl/main-ica.crl.pem # The current CRL
crl_extensions          = crl_ext                       # Extensions to add to a CRL (comment out for V1)
default_crl_days        = 30                            # how long before next CRL

# SHA-1 is deprecated, so use SHA-2 instead.
default_md              = sha256                    # use public key default MD

name_opt                = ca_default                # Subject Name options
cert_opt                = ca_default                # Certificate field options
default_days            = 3650                      # how long to certify for
preserve                = no                        # keep passed DN ordering
policy                  = policy_loose

[ policy_strict ]
# The root CA should only sign intermediate certificates that match.
# See the POLICY FORMAT section of `man ca`.
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ policy_loose ]
# Allow the intermediate CA to sign a more diverse range of certificates.
# See the POLICY FORMAT section of the `ca` man page.
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
# Options for the `req` tool (`man req`).
default_bits            = 4096
prompt = no
distinguished_name      = req_no_prompt # req_distinguished_name or req_no_prompt
string_mask             = utf8only
attributes              = req_attributes

# SHA-1 is deprecated, so use SHA-2 instead.
default_md              = sha256

# Extension to add when the -x509 option is used.
x509_extensions         = v3_ca                 # The extensions to add to the self signed cert

[ req_distinguished_name ]
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
countryName             = Country Name (2 letter code)
stateOrProvinceName     = State or Province Name
localityName            = Locality Name
0.organizationName      = Organization Name
organizationalUnitName  = Organizational Unit Name
commonName              = Common Name
emailAddress            = Email Address

# Field limits
countryName_min         = 2
countryName_max         = 2
commonName_max          = 64
emailAddress_max        = 256

# Optionally, specify some defaults.
#countryName_default    = US
#stateOrProvinceName_default    = California
#localityName_default   = San Jose
#0.organizationName_default     = Home
#organizationalUnitName_default = Home Certificate Authority
#emailAddress_default   = me@mycustomdomain.com

[req_no_prompt]
countryName             = US
stateOrProvinceName     = California
localityName            = San Jose
0.organizationName      = Home
organizationalUnitName  = Main Lab
commonName              = myservice.mycustomdomain.com

[ req_attributes ]

# Commenting out to avoid the challenge password.
# Section still required, though.
#challengePassword      = A challenge password
#challengePassword_min  = 4
#challengePassword_max  = 20
#unstructuredName       = An optional company name

[ v3_ca ]
# Extensions for a typical CA (`man x509v3_config`).
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer
basicConstraints        = critical, CA:true
keyUsage                = critical, digitalSignature, cRLSign, keyCertSign

[ v3_intermediate_ca ]
# Extensions for a typical intermediate CA (`man x509v3_config`).
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer
basicConstraints        = critical, CA:true, pathlen:0
keyUsage                = critical, digitalSignature, cRLSign, keyCertSign

[ usr_cert ]
# Extensions for client certificates (`man x509v3_config`).
basicConstraints        = CA:FALSE
nsCertType              = client, email
nsComment               = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid, issuer
keyUsage                = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage        = clientAuth, emailProtection

[ server_cert ]
# Extensions for server certificates (`man x509v3_config`).
basicConstraints        = CA:FALSE
nsCertType              = server
nsComment               = "OpenSSL Generated Server Certificate"
subjectAltName          = DNS:*.mycustomdomain.com, email:move
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid,issuer:always
keyUsage                = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage        = serverAuth
issuerAltName           = issuer:copy

[ code_signing_cert ]
basicConstraints        = critical, CA:FALSE
extendedKeyUsage        = codeSigning
keyUsage                = critical, digitalSignature
subjectKeyIdentifier    = hash

[ plex_cert ]
# Extensions for server certificates (`man x509v3_config`).

basicConstraints        = CA:FALSE
nsCertType              = server
nsComment               = "OpenSSL Generated Server Certificate"
subjectAltName          = DNS:plex.mycustomdomain.com, DNS:localhost, email:move
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid,issuer:always
keyUsage                = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage        = serverAuth
issuerAltName           = issuer:copy

[ vpn_cert ]
# Extensions for server certificates (`man x509v3_config`).
basicConstraints        = CA:FALSE
nsCertType              = server
nsComment               = "OpenSSL Generated Server Certificate"
subjectAltName          = DNS:pfsense.mycustomdomain.com, email:move
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid,issuer:always
keyUsage                = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage        = serverAuth, 1.3.6.1.5.5.8.2.2
issuerAltName           = issuer:copy

[ crl_ext ]
# Extension for CRLs (`man x509v3_config`).
authorityKeyIdentifier  = keyid:always

[ ocsp ]
# Extension for OCSP signing certificates (`man ocsp`).
basicConstraints        = CA:FALSE
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid,issuer
keyUsage                = critical, digitalSignature
extendedKeyUsage        = critical, OCSPSigning