[ req ]
default_bits        = 4096
distinguished_name  = req_distinguished_name
string_mask         = utf8only
prompt              = no

[ v3_ca ]
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer
basicConstraints        = critical, CA:true
keyUsage                = critical, digitalSignature, cRLSign, keyCertSign
default_md              = sha512
crlDistributionPoints   = {{ intermediate_crl_uri }}
nsCertType              = sslCA, emailCA
issuerAltName           = issuer:copy

[ req_distinguished_name ]
C   = {{ country }}
ST  = {{ state }}
L   = {{ city }}
O   = {{ organization_name }}
OU  = {{ organization_ou }}
CN  = {{ intermediate_organization_cn }}