Add example openssl config

Fixes: freeipa#15

README.md

@@ -2,9 +2,10 @@ These two scripts try to automatically obtain and install Let's Encrypt certs
 to FreeIPA web interface.
 
 To use it, do this:
-* BACKUP /etc/httpd/alias to some safe place (it contains private keys!)
+* BACKUP /var/lib/ipa/certs/ and /var/lib/ipa/private/ to some safe place (it contains private keys!)
 * clone/unpack all scripts including "ca" subdirectory somewhere
-* set WORKDIR and EMAIL variables in scripts setup-le.sh and renew-le.sh
+* set EMAIL variable in renew-le.sh
+* set FQDN in ipa-httpd.cnf
 * run setup-le.sh script once to prepare the machine. The script will:
   * install Let's Encrypt client package
   * install Let's Encrypt CA certificates into FreeIPA certificate store

ipa-httpd.cnf

@@ -0,0 +1,18 @@
+# the fully qualified server (or service) name
+FQDN = server.example.test
+ALTNAMES = DNS:$FQDN
+
+# --- no modifications required below ---
+[ req ]
+default_bits = 2048
+default_md = sha256
+prompt = no
+encrypt_key = no
+distinguished_name = dn
+req_extensions = req_ext
+
+[ dn ]
+CN = $FQDN
+
+[ req_ext ]
+subjectAltName = $ALTNAMES