server.conf

# TLS server certificate request

[ default ]
SAN                     = DNS:yourdomain.tld    # Default value

[ req ]
default_bits            = 2048                  # RSA key size
encrypt_key             = no                    # Protect private key
default_md              = sha1                  # MD to use
prompt                  = yes                   # Prompt for DN
distinguished_name      = server_dn             # DN template
req_extensions          = server_reqext         # Desired extensions

[ server_dn ]
countryName_default             = "US"
stateOrProvinceName_default     = "California"
localityName_default            = "Mountain View"
organizationName_default        = "Google"
organizationalUnitName_default  = "Enterprise"
commonName              = "Common Name (eg, FQDN)     "
commonName_max          = 64

[ server_reqext ]
keyUsage                = critical,digitalSignature
extendedKeyUsage        = serverAuth
subjectKeyIdentifier    = hash
subjectAltName          = $ENV::SAN