From df018b24b41baf41e6c5fa2de0c8acecb1778c18 Mon Sep 17 00:00:00 2001
From: Klas Lindfors <klas@yubico.com>
Date: Thu, 9 Apr 2015 10:13:30 +0200
Subject: [PATCH] add more extensions for certificates in doc

---
 doc/Certificate_Authority_with_NEO.adoc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/Certificate_Authority_with_NEO.adoc b/doc/Certificate_Authority_with_NEO.adoc
index a7be6ae..b607b74 100644
--- a/doc/Certificate_Authority_with_NEO.adoc
+++ b/doc/Certificate_Authority_with_NEO.adoc
@@ -193,8 +193,10 @@ Then generate a new private key and certificate request:
 Then sign the certificate using the NEO:
 
   cat>yubico-internal-https-ee-$host-crt.conf<<EOF
+  basicConstraints = critical,CA:false
   keyUsage=critical,digitalSignature,keyEncipherment
   extendedKeyUsage=critical,serverAuth
+  subjectAltName=critical,DNS:$host.yubico.com
   EOF
   openssl << EOF
   engine dynamic -pre SO_PATH:/usr/lib/engines/engine_pkcs11.so -pre ID:pkcs11 -pre NO_VCHECK:1 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -pre VERBOSE