I'm generating a self-signed SSL cert:

$ openssl req -x509 -newkey rsa:2048 -subj 'CN=example.com'

I'd like to specify a subjectAltName also at creation time, but I cannot find info in the openssl manpage on how to do this.

  • 2
    There is no command line switch. You have to write it into a config file and then use this config file. – Steffen Ullrich Aug 25 '14 at 19:19

Try to write the subjectAltName to a temporary file (I'll name it hostextfile) like


and link to it in openssl command via "-extfile" option, for example:

openssl ca -days 730 -in hostreq.pem -out -hostcert.pem -extfile hostextfile
  • 1
    I believe that is correct. X509v3 Subject Alternative Name: DNS:kb.example.com, DNS:helpdesk.example.com – quadruplebucky Nov 18 '14 at 12:28
  • I used this description. – Viktor Nov 18 '14 at 12:38

The openssl command doesn’t provide a way to include extensions like the subjectAltName without writing a config file first. I have written a simple utility that does it all automatically. It's available on github: https://github.com/rtts/certify

Example use:

./certify example.com www.example.com mail.example.com

This will create a file named example.com.crt that contains a certificate with the Subject Alternative Names of example.com, www.example.com, and mail.example.com.


Create self-signed certificate with SubjectAltName

cd /etc/ssl

cat > my.conf <<- "EOF"
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
CN = www.dmkd.dp.ua

[ req_ext ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[ alt_names ]
DNS.0 = www.dmkd.dp.ua
DNS.1 = dmkd.dp.ua


# Create key
openssl genrsa -des3 -out server.key.secure 2048
# Disable secret phrase for key
openssl rsa -in server.key.secure -out server.insecure.key
# Create request certificate file with params from file my.conf
openssl req -new -key server.insecure.key -out server.csr -config my.conf
# Create certificate with params from file my.conf
openssl x509 -req -days 365 -in server.csr -signkey server.insecure.key -out server.crt -extensions req_ext -extfile my.conf
# Check request file and certificate for SubjectAltName precense
openssl req -text -noout -in server.csr
openssl x509 -in server.crt -text -noout

I used info here, but thinned it out to just the info needed to satisfy the browswer..

x509 v3 extensions option file:

echo "subjectAltName = @alt_names

DNS.1 = www.example.com" > v3.ext

External Keyfile:

openssl genrsa -out www.example.com.key 2048

CA Signing Request:(Assumes you have the CA key and cert)

openssl req -new -key www.example.com.key -subj "/CN=www.example.com" -out www.example.com.csr

Sign the request to create the cert, and include the x509 Extension data:

openssl x509 -req -in www.example.com.csr -CA ca.example.com.crt -CAkey ca.example.com.key -CAcreateserial -out www.example.com.crt -days 500 -sha256 -extfile v3.ext

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.