server.conf

# TLS server certificate request

# This file is used by the openssl req command. The subjectAltName cannot be
# prompted for and must be specified in the SAN environment variable.

[ req ]
default_bits            = 2048                  # RSA key size
encrypt_key             = no                    # Protect private key
default_md              = sha1                  # MD to use
utf8                    = yes                   # Input is UTF-8
string_mask             = utf8only              # Emit UTF-8 strings
prompt                  = no                    # Prompt for DN
distinguished_name      = server_dn             # DN template
req_extensions          = server_reqext         # Desired extensions

[ server_dn ]
0.domainComponent           = "org"
1.domainComponent           = "cheese"
0.organizationName          = "Cheese"
1.organizationName          = "Cheese 2"
0.organizationalUnitName    = "Simple Signing Section"
1.organizationalUnitName    = "Simple Signing Section 2"
0.commonName                = "*.cheese.org"
1.commonName                = "*.cheese.com"
0.countryName               = "FR"
1.countryName               = "US"
0.localityName              = "TOULOUSE"
1.localityName              = "LYON"
0.stateOrProvinceName       = "Cheese org state"
1.stateOrProvinceName       = "Cheese com state"
0.emailAddress              = "cert@cheese.org"
1.emailAddress              = "cert@scheese.com"

[ server_reqext ]
keyUsage                = critical,digitalSignature,keyEncipherment
extendedKeyUsage        = serverAuth,clientAuth
subjectKeyIdentifier    = hash
subjectAltName          = @alt_names

[alt_names]
DNS.1   = *.cheese.org
DNS.2   = *.cheese.net
DNS.4   = *.cheese.com
IP.1    = 10.0.1.0
IP.2    = 10.0.1.2
email.1  = test@cheese.org
email.2  = test@cheese.net