certificate/certificates/extensions.conf

[v3_ca_nc]
basicConstraints=CA:TRUE
keyUsage=digitalSignature, keyEncipherment, keyCertSign
nameConstraints=permitted;dirName:dn

[dn]
C=US
ST=California
O=Google Inc

[v3_req]
basicConstraints=CA:FALSE
keyUsage=digitalSignature, keyEncipherment