Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

To create a certificate request containing subject alternative names (SANs) for a host, with openssl, I can use a config file like this (snipped):

req_extensions = v3_req
[ v3_req ]
subjectAltName = @alt_names
DNS = xyz.example.com

If I need to provide a distinguished name or a user principal name, how should I configure the alt_names section for a user certificate request?
For example, I tried

UPN = xyz@example.com

But I got this error:

Error Loading request extension section v3_req
5356:error:22075075:X509 V3 routines:v2i_GENERAL_NAME_ex:unsupported option:.\crypto\x509v3\v3_alt.c:557:name=userPrincipalName
5356:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension:.\crypto\x509v3\v3_conf.c:93:name=subjectAltName, value=@alt_names
share|improve this question

2 Answers 2

You can specify pretty much anything that your CA allows.

The relevant RFC is RFC5280. It says in section "Subject Alternative Name"

The subject alternative name extension allows identities to be bound to the subject of the certificate. These identities may be included in addition to or in place of the identity in the subject field of the certificate. Defined options include an Internet electronic mail address, a DNS name, an IP address, and a Uniform Resource Identifier (URI). Other options exist, including completely local definitions. Multiple name forms, and multiple instances of each name form, MAY be included. Whenever such identities are to be bound into a certificate, the subject alternative name (or issuer alternative name) extension MUST be used; however, a DNS name MAY also be represented in the subject field using the domainComponent attribute as described in Section Note that where such names are represented in the subject field implementations are not required to convert them into DNS names.

You should read the rest of that section, and then check with your CA what they support. It's worth noting that your CA must verify that all subject alternative names are correct.

To use an email address, the RFC says in section

Conforming implementations generating new certificates with electronic mail addresses MUST use the rfc822Name in the subject alternative name extension (Section to describe such identities. Simultaneous inclusion of the emailAddress attribute in the subject distinguished name to support legacy implementations is deprecated but permitted.

So instead of UPI, you should use rfc822Name.

share|improve this answer
Thank you very much for your answer (and for making me discover acme.com) but I actually just need to know what I should write in the openssl config file to get, for example, a UPN SAN. I edited my question to make it clearer now. –  Paolo Tedesco May 19 '14 at 9:07
Ah, got it! Give me a minute, I'll update my answer with specific information about email. –  Jenny D May 19 '14 at 9:15
Thanks again, that was a good idea, but actually it turn out that openssl just wants some special tags in the configuration file, which I discovered checking the source code... –  Paolo Tedesco May 19 '14 at 9:30
I'm glad you found it! –  Jenny D May 19 '14 at 10:11

After trying some options (thanks Jenny) I just checked the source code, and discovered that the configuration file expects one of these values:

  • email
  • URI
  • DNS
  • RID
  • IP
  • dirName
  • otherName

So in my case I wrote

email = xyz@example.com

And openssl generated the request file.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.