I am trying to generate a SSL certificate that after being signed by my own CA will work for multiple domains.
My openssl configuration file looks like this:
[ req ] default_bits = 2048 distinguished_name = req_distinguished_name req_extensions = req_ext [ req_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = DE stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = Berlin localityName = Locality Name (eg, city) localityName_default = organizationName = Organization Name (eg, company) organizationName_default = commonName = Common Name (eg, your domain) commonName_default = example.com commonName_max = 64 [ req_ext ] subjectAltName = @alt_names [ alt_names ] DNS.1 = example.com DNS.2 = a.example.com DNS.3 = b.example.com
The resulting CSR looks like this:
Certificate Request: Data: Version: 0 (0x0) Subject: C=DE, ST=Berlin, CN=example.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: ... Exponent: 65537 (0x10001) Attributes: Requested Extensions: X509v3 Subject Alternative Name: DNS:example.com, DNS:a.example.com, DNS:b.example.com Signature Algorithm: sha1WithRSAEncryption ...
However after installing this on apache, the browsers (both chrome and firefox) do not seems to see or respect the SAN.
example.com works due to the common name, the two subdomains don't.
What am I doing wrong? How can I troubleshoot this?
(I have simplified the example here. Wildcard certs are not an option)