[ req ]
default_bits            = 1024
prompt                  = no
distinguished_name      = req_dn

[ req_dn ]
commonName              = myCompany CA
organizationName	= myCompany

[ ext ]
basicConstraints=CA:TRUE
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always

[ req ]
default_bits            = 1024
prompt                  = no
distinguished_name      = req_dn

[ req_dn ]
commonName              = myCompany CA
organizationName	= myCompany

[ ext ]
basicConstraints=CA:FALSE
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
subjectAltName=DNS:subdomain.mycompany.com

openssl req -new -out carequest.pem -newkey rsa:1024 -keyout cakey.pem -config caconfig1.conf -nodes -sha1
openssl x509 -req -signkey cakey.pem -in carequest.pem -out cafile.pem -extfile caconfig1.conf -extensions ext -days 365 -sha1

openssl req -new -out tmp.req -newkey rsa:1024 -keyout tmp.key -config caconfig2.conf -nodes -sha1
openssl x509 -req -CAkey cakey.pem -CA cafile.pem -CAcreateserial -in tmp.req -out tmp.crt -extfile caconfig2.conf -extensions ext -days 365 -sha1

cat tmp.crt tmp.key > agent.pem

NONE:         Do not verify Peer Certificates. (default setting)
IN:           Drop incoming connections which fail signature verification against trusted certificate authorities. Peers must provide a certificate during the initial TLS Handshake.
OUT:          Drop outgoing connections which fail signature verification against trusted certificate authorities.
ALL:          Alias for (IN|OUT)
SUBJECTS_IN:  Match the certificate subject on incoming connections against a provided list. If no match is found, the connection is rejected. If no list is provided, subject checking is bypassed. Note: Implies IN.
SUBJECTS_OUT: Match the certificate subject on outgoing connections against a provided list. If no match is found, the connection is rejected. Note: Implies OUT.
SUBJECTS_ALL: Alias for (SUBJECTS_IN|SUBJECTS_OUT)

tls_verify_policy=IN
tls_verify_policy=OUT
tls_verify_policy=IN|OUT (is the same as tls_verify_policy=ALL)