[ req ]
distinguished_name = req_distinguished_name
x509_extensions     = v3_ca
prompt              = no

[ req_distinguished_name ]
CN = registry.local

[ v3_ca ]
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid:always,issuer
# ZWINGEND NOTWENDIG FÜR K3S: Sagt der Kubelet-Engine, dass dies eine gültige CA ist!
basicConstraints       = critical, CA:true
keyUsage               = critical, digitalSignature, cRLSign, keyCertSign
subjectAltName         = @alt_names

[ alt_names ]
DNS.1 = registry.local
DNS.2 = nginx
DNS.3 = localhost