[req]
distinguished_name = req_distinguished_name
prompt             = no
x509_extensions    = ca_x509_extensions
 
[ca_x509_extensions]
basicConstraints = CA:TRUE
keyUsage         = cRLSign, keyCertSign
 
[req_distinguished_name]
CN  = Cilium
C  = RU
ST = Moscow
L  = Moscow
 
[clustermesh-server]
distinguished_name = clustermesh-server_distinguished_name
prompt             = no
req_extensions     = clustermesh-server_req_extensions
 
[clustermesh-server_req_extensions]
basicConstraints     = CA:FALSE
extendedKeyUsage     = clientAuth, serverAuth
keyUsage             = critical, digitalSignature, keyEncipherment
nsCertType           = client
nsComment            = "Clustermesh Server Certificate"
subjectAltName       = @clustermesh-server_alt_names
subjectKeyIdentifier = hash
 
[clustermesh-server_distinguished_name]
C  = RU
ST = Moscow
L  = Moscow
 
[clustermesh-server_alt_names]
IP.0  = <clustermesh-ip>
DNS.0 = clustermesh-apiserver.cilium.io
DNS.1 = *.mesh.cilium.io
DNS.2 = localhost
DNS.3 = clustermesh-apiserver.kube-system.svc.cluster.local
DNS.4 = clustermesh-apiserver.kube-system
DNS.5 = clustermesh-apiserver
DNS.6 = clustermesh-apiserver.kube-system.svc
 
# Clustermesh Admin Cert
 
[clustermesh-admin]
distinguished_name = clustermesh-admin_distinguished_name
prompt             = no
req_extensions     = clustermesh-admin_req_extensions
 
[clustermesh-admin_req_extensions]
basicConstraints     = CA:FALSE
extendedKeyUsage     = clientAuth, serverAuth
keyUsage             = critical, digitalSignature, keyEncipherment
nsCertType           = client
nsComment            = "Clustermesh Admin Certificate"
subjectAltName       = @clustermesh-admin_alt_names
subjectKeyIdentifier = hash
 
[clustermesh-admin_distinguished_name]
CN = root
O  = Cilium
C  = RU
ST = Moscow
L  = Moscow
 
[clustermesh-admin_alt_names]
IP.0  = <clustermesh-ip>
DNS.0 = localhost
DNS.1 = clustermesh-apiserver.kube-system.svc.cluster.local
DNS.2 = clustermesh-apiserver.kube-system
DNS.3 = clustermesh-apiserver
DNS.4 = clustermesh-apiserver.kube-system.svc
 
# Clustermesh Client Cert
 
[clustermesh-client]
distinguished_name = clustermesh-client_distinguished_name
prompt             = no
req_extensions     = clustermesh-client_req_extensions
 
[clustermesh-client_req_extensions]
basicConstraints     = CA:FALSE
extendedKeyUsage     = clientAuth, serverAuth
keyUsage             = critical, digitalSignature, keyEncipherment
nsCertType           = client
nsComment            = "Clustermesh Client Certificate"
subjectKeyIdentifier = hash
 
[clustermesh-client_distinguished_name]
CN = remote
O  = Cilium
C  = RU
ST = Moscow
L  = Moscow
 
[clustermesh-client_alt_names]
IP.0  = <clustermesh-ip>
DNS.0 = localhost
DNS.1 = clustermesh-apiserver.kube-system.svc.cluster.local
DNS.2 = clustermesh-apiserver.kube-system
DNS.3 = clustermesh-apiserver
DNS.4 = clustermesh-apiserver.kube-system.svc