- Don't set alternative names for CA cert.

certs = \$dir/certs

certificate = \$dir/CA.crt

private_key = \$dir/CA.key

default_md = sha1

default_md = sha256

default_days = 365

email_in_dn = no

RANDFILE = /dev/urandom

distinguished_name = req_distinguished_name

prompt = no

encrypt_key = no

default_md = sha1

default_md = sha256

default_bits = 2048

RANDFILE = /dev/urandom

#O = Organization name

#OU = Organizational unit

#emailAddress = email address

CN = \${ENV::domain}

CN = \${ENV::cn}

[ v3_ca ]

basicConstraints = CA:true

subjectAltName = DNS:*.\${ENV::domain}, DNS:*.*.\${ENV::domain}

[ v3_req ]

basicConstraints = CA:false

subjectAltName = DNS:*.\${ENV::domain}

subjectAltName = DNS:*.\${ENV::cn}

"

usage () {

}

init () {

    export domain="$(basename $PWD)"

    export cn="$(basename $PWD)"

    mkdir -p certs keys

    if [ -e openssl.cnf ]

    then

        exit 1

    fi

    csr="$(mktemp -t ssl-ca-XXXXXXXXX)"

    export domain="$1.$(basename $PWD)"

    export cn="$1.$(basename $PWD)"

    openssl req \

        -key keys/$1 \

        -new \