I'm generating a self-signed SSL cert:

$ openssl req -x509 -newkey rsa:2048 -subj 'CN=example.com'

I'd like to specify a subjectAltName also at creation time, but I cannot find info in the openssl manpage on how to do this.


5 Answers 5


Try to write the subjectAltName to a temporary file (I'll name it hostextfile) like

subjectAltName=email:[email protected],RID:

and link to it in openssl command via "-extfile" option, for example:

openssl ca -days 730 -in hostreq.pem -out -hostcert.pem -extfile hostextfile
  • 1
    I believe that is correct. X509v3 Subject Alternative Name: DNS:kb.example.com, DNS:helpdesk.example.com Nov 18, 2014 at 12:28
  • I used this description.
    – Viktor
    Nov 18, 2014 at 12:38
  • What is -extfile? It's not known to my openssl (v1.1) and it's not listed on the manpage...
    – Marc
    Sep 22, 2021 at 18:41
  • @Marc openssl v1.1.1 man surely knows what option (and not a command) extfile is.It defines extfile as "additional configuration file to read certificate extensions from (using the default section unless the -extensions option is also used)".
    – Viktor
    Sep 23, 2021 at 9:24

The openssl command doesn’t provide a way to include extensions like the subjectAltName without writing a config file first. I have written a simple utility that does it all automatically. It's available on github: https://github.com/rtts/certify

Example use:

./certify example.com www.example.com mail.example.com

This will create a file named example.com.crt that contains a certificate with the Subject Alternative Names of example.com, www.example.com, and mail.example.com.


Create self-signed certificate with SubjectAltName

cd /etc/ssl

cat > my.conf <<- "EOF"
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
CN = www.dmkd.dp.ua

[ req_ext ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[ alt_names ]
DNS.0 = www.dmkd.dp.ua
DNS.1 = dmkd.dp.ua


# Create key
openssl genrsa -des3 -out server.key.secure 2048
# Disable secret phrase for key
openssl rsa -in server.key.secure -out server.insecure.key
# Create request certificate file with params from file my.conf
openssl req -new -key server.insecure.key -out server.csr -config my.conf
# Create certificate with params from file my.conf
openssl x509 -req -days 365 -in server.csr -signkey server.insecure.key -out server.crt -extensions req_ext -extfile my.conf
# Check request file and certificate for SubjectAltName precense
openssl req -text -noout -in server.csr
openssl x509 -in server.crt -text -noout
  • thanks, @venoel. great. Apr 9, 2022 at 7:59

I used info here, but thinned it out to just the info needed to satisfy the browswer..

x509 v3 extensions option file:

echo "subjectAltName = @alt_names

DNS.1 = www.example.com" > v3.ext

External Keyfile:

openssl genrsa -out www.example.com.key 2048

CA Signing Request:(Assumes you have the CA key and cert)

openssl req -new -key www.example.com.key -subj "/CN=www.example.com" -out www.example.com.csr

Sign the request to create the cert, and include the x509 Extension data:

openssl x509 -req -in www.example.com.csr -CA ca.example.com.crt -CAkey ca.example.com.key -CAcreateserial -out www.example.com.crt -days 500 -sha256 -extfile v3.ext

These days (openssl-3.3.0) openssl req has an -addext option:

openssl req -x509 -subj /CN=example.com -days 365 -noenc \
    -CA root.crt -CAkey root.key -extensions usr_cert \
    -addext "subjectAltName = DNS:example.com, email:[email protected], IP:" \
    -out server.crt -keyout server.key

It was added in openssl-1.1.1 (2017-12-28).

See x509v3_config which describes how to specify extensions.

You might also want to check out the following gist which lists some ways to generate SSL certificates.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .