[ CA_default ]
dir            = ./
certificate    = $dir/ca.pem
private_key    = $dir/ca.key
# ...standardní pole...
preserve       = no
copy_extensions = copy # bez toho SAN ze CSR do certifikátu nepřejde
policy         = policy_match

[ req ]
prompt             = no
distinguished_name = server
default_bits       = 2048
input_password     = heslo_ca_klice
output_password    = heslo_server_klice
req_extensions     = v3_req # extensions jdou do CSR

[server]
countryName            = CZ
stateOrProvinceName    = Czech Republic
organizationName       = Eida.cz EXAMPLE
commonName             = "Eida.cz RADIUS Server"
emailAddress           = example@eida.lan

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage         = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName   = @alt_names # SAN sekce

[alt_names]
# sdílený logický hostname — stejný text v TLSTrustedServerNames v mobileconfig
DNS.1 = radius.eida.lan
# volitelně – specifický hostname tohoto serveru
DNS.2 = dc1.eida.lan