anchor.diff:  subjectKeyIdentifier   = hash
   authorityKeyIdentifier = keyid,issuer:always
   extendedKeyUsage       = serverAuth
  -keyUsage               = digitalSignature, keyEncipherment".+keyUsage               = digitalSignature, keyEncipherment
  +subjectAltName         = @alt_names
  +
  +[ alt_names ]
  +DNS.1                  = " ++ str_utils:to_list(Hostname).
  
positive.code: x509_extensions        = server_cert
  default_days           = 3650
  default_crl_days       = 30
  default_md             = sha1
  preserve               = no
  policy                 = policy_anything
  
  
negative.code: %% cert.
  %% @end
  %%--------------------------------------------------------------------
  -spec create_temp_ca_dir(Hostname :: string() | binary()) ->
      {Root :: file:filename_all(), ConfigFile :: file:filename_all()}.
  create_temp_ca_dir(Hostname) ->
      Root = utils:mkdtemp(),
      ConfigFile = filename:join(Root, "openssl.cfg"),
      IndexFile = filename:join(Root, "index.txt"),
      SerialFile = filename:join(Root, "serial"),
      RandomSerial = httpd_util:integer_to_hexlist(999999999 + rand:uniform(999999999)),
      file:write_file(ConfigFile, openssl_cnf(Root, Hostname)),
      file:write_file(IndexFile, <<"">>),
      file:write_file(SerialFile, RandomSerial),
      {Root, ConfigFile}.
  