It is an arbitrary, administrative decision for the creator of CA what client certificates they want to enable to be signed by the CA.
The policy_match
in the following configuration line:
policy = policy_match
is a chosen name that corresponds to a particular section in the configuration file. That section defines in details each of the
[ policy_match ]
countryName = match
stateOrProvinceName = match
localityName = supplied
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
Each of the DN fields for the client certificate can be assigned to have the same value as the CA (match
), be required to be specified (supplied
), or be optional (optional
).
The same guide suggests another policy that matches your criteria of "the client could be an arbitrary entity that has nothing in common with the CA":
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
Yet if you wanted to create a CA for your organisation, that would allow issuing only certificates for that part of your organisation you can freely set for example:
policy = policy_branch_1
[ policy_branch_1 ]
countryName = match
stateOrProvinceName = match
localityName = match
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = supplied
Which would required the issued certificates to have first three DN fields matching the CA's certificate.
openssl ca
are NOT selfsigned; selfsigned does mean signed under control of the same person, it means signed with the same key as is in the cert.