Improve example CA setup

The example CA now has more realistic 2 levels with a root CA and a sub CA.

Setup script and ca.cnf has been changed to create a root CA and a sub CA
that is signed by the root CA. The sub CA is used for signing the end entity
certificates. Example CA directory has been changed to example_ca for better
readability.

setup_example_ca.sh

@@ -1,11 +1,39 @@
 #!/bin/sh
 
-if [ ! -d "exampleca" ]; then
-  mkdir -p exampleca/newcerts
-  touch exampleca/index.txt
+set -eu
+
+COUNTRY_CODE=CH
+ORGANIZATION="Acme Ltd."
+
+if [ ! -d "example_ca" ]; then
+  mkdir -p example_ca/root/newcerts example_ca/sub/newcerts
+  touch example_ca/root/index.txt example_ca/sub/index.txt
   umask 077
-  mkdir exampleca/private
-  openssl req -new -x509 -keyout exampleca/private/ca.key.pem -out exampleca/ca.crt.pem -days 3650 \
-    -subj "/CN=Example CA" -nodes -newkey rsa:3072 -addext "basicConstraints=critical,CA:true,pathlen:0"
-  chmod +r exampleca/ca.crt.pem
+  mkdir example_ca/root/private example_ca/sub/private
+  openssl req -new -x509 \
+    -config ca.cnf \
+    -keyout example_ca/root/private/ca.key.pem \
+    -newkey rsa:3072 \
+    -nodes \
+    -subj "/CN=Example Root CA/C=${COUNTRY_CODE}/O=${ORGANIZATION}" \
+    -utf8 \
+    -days 3650 \
+    -out example_ca/root/ca.crt.pem
+  chmod +r example_ca/root/ca.crt.pem
+  openssl req -new \
+    -config ca.cnf \
+    -keyout example_ca/sub/private/ca.key.pem \
+    -newkey rsa:3072 \
+    -nodes \
+    -subj "/CN=Example Sub CA/C=${COUNTRY_CODE}/O=${ORGANIZATION}" \
+    -utf8 \
+    -out example_ca/sub/ca.csr.pem
+  openssl ca \
+    -config ca.cnf \
+    -name rootca \
+    -in example_ca/sub/ca.csr.pem \
+    -extensions sub_ca \
+    -out example_ca/sub/ca.crt.pem \
+    -create_serial \
+    -batch
 fi