0

I want to generate CSR for two domains. I have tried according to this http://apetec.com/support/GenerateSAN-CSR.htm But there is no such section available in openssl.cnf file and i don't want to edit openssl.cnf Also tried http://blog.endpoint.com/2014/10/openssl-csr-with-alternative-names-one.html but this generate error like this

problems making Certificate Request 140391851812680:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:154:maxsize=2

Any Idea how to add two Subject Aleternative Name while generating Certificate request

2
  • Have you tried to set it up in the openssl.cnf to something like subjectAltName=$ENV::SAN and use environment variable SAN to set up its value? Dec 11, 2015 at 7:45
  • But i don't want to edit openssl.cnf. If i edit openssl.cnf and add those two domain then in future if i need to generate csr for different domain then those domain which are in openssl.cnf automatically included. Dec 11, 2015 at 7:48

1 Answer 1

1

Use a local config file

Just use a separate config file.

Then when you actually make the request tell OpenSSL to use the local config file with the -config <filename> parameter.

Like so:

openssl req -new -key example.key -config example-config.ini -out example.req 

That way you don't have to edit the global config.

Also: I like to use the .ini file name extension for my OpenSSL config files, because that allows for nice doubleclickability and helpful syntax highlighting when you edit the file in a good text editor (like Notepad++). (And OpenSSL does not care about the extension, so ".ini" is what I will pick.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .