I wish to configure OpenSSL such that when running
openssl req -new to generate a new certificate signing request, I am prompted for any alternative subject names to include on the CSR.
I have added this line to the
[req_attributes] section of my
subjectAltName = Alternative subject names
This has the desired effect that I am now prompted for SANs when generating a CSR:
$ openssl req -new -out test.csr -key ./test.key <<< You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [US]: State or Province Name (full name) [New York]: Locality Name (eg, city) : Organization Name (eg, company) [Example Co]: Organizational Unit Name (eg, section) : Common Name (e.g. server FQDN or YOUR name) :test.example.com Email Address : Please enter the following 'extra' attributes to be sent with your certificate request A challenge password : An optional company name : Alternative subject names :DNS:alt1.example.com
In the above example, I have entered
DNS:alt1.example.com when prompted for the SANs.
The problem is that the resulting CSR does not appear to be well formatted:
$ openssl req -text -in ./test.csr Certificate Request: Data: Version: 0 (0x0) Subject: C=US, ST=New York, O=The Banes, CN=test.thebanes.org Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: [...] Exponent: 65537 (0x10001) Attributes: X509v3 Subject Alternative Name:unable to print attribute
OpenSSL complains that it is unable to print the value of the Subject Alternative Name attribute. From examples online (where people hard-code the SANs into their openssl.cnf, rather than prompting for them interactively as I want), I expect to see this instead:
Attributes: X509v3 Subject Alternative Name: DNS:alt1.example.com
So, how can I generate a well-formed CSR with interactively prompted SANs?