[ca] Do not require matching CA parameters.

See https://security.stackexchange.com/a/130488.

diff --git a/ca/ca.cnf b/ca/ca.cnf
index bc13b8b9510df486bb97493c3693f9a7645decbb..5c58fe7474afccf1ea05783b7550797905105963 100644 (file)
--- a/ca/ca.cnf
+++ b/ca/ca.cnf
@@ -83,7 +83,7 @@ preserve        = no                    # keep passed DN ordering
 # A few difference way of specifying how similar the request should look
 # For type CA, the listed attributes must be the same, and the optional
 # and supplied fields are just that :-)
-policy          = policy_match
+policy          = policy_anything
 
 # For the CA policy
 [ policy_match ]