158a159
> # http://stackoverflow.com/questions/24255205/openssl-error-loading-extension-section-usr-cert
171c172
< # nsCertType			= server
---
> # nsCertType            = server
186c187
< nsComment			= "Easy-RSA Generated Certificate"
---
> nsComment           = "OpenSSL Generated Certificate"
190,193c191
< authorityKeyIdentifier=keyid,issuer:always
< extendedKeyUsage=clientAuth
< keyUsage = digitalSignature
<
---
> authorityKeyIdentifier=keyid,issuer
198c196,198
< subjectAltName=$ENV::KEY_ALTNAMES
---
> # An alternative to produce certificates that aren't
> # deprecated according to PKIX.
> # subjectAltName=email:move
203c203
< #nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
---
> #nsCaRevocationUrl      = http://www.domain.dom/ca-crl.pem
209a210,211
> # This is required for TSA certificates.
> # extendedKeyUsage = critical,timeStamping