Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wish to configure OpenSSL such that when running openssl req -new to generate a new certificate signing request, I am prompted for any alternative subject names to include on the CSR.

I have added this line to the [req_attributes] section of my openssl.cnf:

subjectAltName                  = Alternative subject names

This has the desired effect that I am now prompted for SANs when generating a CSR:

$ openssl req -new -out test.csr -key ./test.key                            <<<
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [US]:
State or Province Name (full name) [New York]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Example Co]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Alternative subject names []

In the above example, I have entered when prompted for the SANs.

The problem is that the resulting CSR does not appear to be well formatted:

$ openssl req -text -in ./test.csr
Certificate Request:
        Version: 0 (0x0)
        Subject: C=US, ST=New York, O=The Banes,
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
            X509v3 Subject Alternative Name:unable to print attribute

OpenSSL complains that it is unable to print the value of the Subject Alternative Name attribute. From examples online (where people hard-code the SANs into their openssl.cnf, rather than prompting for them interactively as I want), I expect to see this instead:

            X509v3 Subject Alternative Name:

So, how can I generate a well-formed CSR with interactively prompted SANs?

share|improve this question
Unfortunately I think there is no solution to do that with "pure" openssl - you would need a script that will mangle its config file for that. :( PS A proven solution to do that in a non-interactive manner is here: – Greg Dubicki Jan 31 at 13:26

I've battled with this little nugget myself ... what a PITA!

My solution: I moved the all of openssl.cnf file into a Template Toolkit file leaving only the sans piece as the replacement piece, then wrapped a perl script around it.

The perl script prompts for the SANs entries, then inserts them into the template, saves the template to a temp file and then I call openssl req with the -config option pointed at the temp file. discard the temp file after the CSR is generated.

You also might want to look at:

There are others who override $ENV just prior to execution and wrap the call to openssl req in perl or shell and accomplish the same thing in a slightly more efficient manner:

share|improve this answer
The $ENV solution didn't work for me. :( – Greg Dubicki Jan 31 at 13:21

This "subjectAltName" should not be in this section: attributes = req_attributes. But in a section for req_extensions = (call it whatever you want).

And no need for all the BS like

subjectAltName           = Alternative subject names
subjectAltName_default   =

Just type in what you want, how many you want:

subjectAltName = DNS:*,, DNS:

(The last one makes internal access like "" without warning)

So something like:

[ req ]
req_extensions     = my_extensions

subjectAltName     = DNS:*,, DNS:


share|improve this answer
This is NOT what OP asked for - he wanted an interactive solution. – Greg Dubicki Jan 31 at 13:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.