{
  config.local.pki.ca = {
    home = {
      crl = ./public/home-crl.pem;
      cert = ./public/home-ca.pem;
      issuer = "root";

      leaves = {
        user-firefox.cert = ./public/home-user-firefox.pem;
      };
    };

    mail = {
      crl = ./public/mail-crl.pem;
      cert = ./public/mail-ca.pem;
      issuer = "root";

      leaves = {
        kiev.cert = ./public/mail-kiev.pem;
        larsa.cert = ./public/mail-larsa.pem;
      };
    };

    root = {
      crl = ./public/root-crl.pem;
      cert = ./public/root-ca.pem;
      issuer = null;
      leaves = { };
    };
  };
}