I want to generate CSR for two domains. I have tried according to this http://apetec.com/support/GenerateSAN-CSR.htm But there is no such section available in openssl.cnf file and i don't want to edit openssl.cnf Also tried http://blog.endpoint.com/2014/10/openssl-csr-with-alternative-names-one.html but this generate error like this

problems making Certificate Request 140391851812680:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:154:maxsize=2

Any Idea how to add two Subject Aleternative Name while generating Certificate request

  • Have you tried to set it up in the openssl.cnf to something like subjectAltName=$ENV::SAN and use environment variable SAN to set up its value? Dec 11, 2015 at 7:45
  • But i don't want to edit openssl.cnf. If i edit openssl.cnf and add those two domain then in future if i need to generate csr for different domain then those domain which are in openssl.cnf automatically included. Dec 11, 2015 at 7:48

1 Answer 1


Use a local config file

Just use a separate config file.

Then when you actually make the request tell OpenSSL to use the local config file with the -config <filename> parameter.

Like so:

openssl req -new -key example.key -config example-config.ini -out example.req 

That way you don't have to edit the global config.

Also: I like to use the .ini file name extension for my OpenSSL config files, because that allows for nice doubleclickability and helpful syntax highlighting when you edit the file in a good text editor (like Notepad++). (And OpenSSL does not care about the extension, so ".ini" is what I will pick.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.