openssl.conf

[ ca ]
default_ca = CA_default

[ CA_default ]
dir               = ./testssl
certs             = $dir/certs
crl_dir           = $dir/crl
new_certs_dir     = $dir/newcerts
database          = $dir/index.txt
serial            = $dir/serial
private_key       = $dir/ca-key.pem
certificate       = $dir/ca-cert.pem
default_md        = sha256
name_opt          = ca_default
cert_opt          = ca_default
default_days      = 375
preserve          = no
policy            = policy_default

[ policy_default ]
countryName             = optional
stateOrProvinceName     = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
default_bits        = 4096
string_mask         = utf8only
default_md          = sha256
distinguished_name  = req_distinguished_name
req_extensions      = v3_server
copy_extensions     = copy
x509_extensions     = v3_server

[ req_distinguished_name ]
countryName                     = Country
countryName_max                 = 2
stateOrProvinceName             = State
localityName                    = Locality
0.organizationName              = Organization
organizationalUnitName          = Organizational Unit
commonName                      = Common Name
commonName_max                  = 64
emailAddres                     = Email
emailAddress_max                = 64
countryName_default             = EU
stateOrProvinceName_default     = 
localityName_default            = Locality
0.organizationName_default      = Localhost
organizationalUnitName_default  = Localnet

[ v3_server ]
subjectKeyIdentifier = hash
#authorityKeyIdentifier      = keyid:always, issuer:always
basicConstraints = critical, CA:false
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, keyAgreement 
extendedKeyUsage = critical, serverAuth, clientAuth

# https://superuser.com/questions/738612/openssl-ca-keyusage-extension
[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier      = keyid:always, issuer:always
basicConstraints = critical, CA:TRUE
keyUsage = critical, cRLSign, digitalSignature, keyCertSign