4

I have a pair of Root CA keys. How to issue a new SSL certificate with SAN (Subject Alternative Name) extension? I tried this

openssl genrsa -out ssl.key 2048
openssl req -new -config ssl.conf -key ssl.key -out ssl.csr
openssl x509 -req -sha256 -days 3650 -CAcreateserial -CAkey root.key -CA root.crt -in ssl.csr -out ssl.crt

ssl.conf:

[req]
prompt = no
distinguished_name = req_distinguished_name
x509_extensions = v3_ca

[req_distinguished_name]
CN = 127.0.0.1

[v3_ca]
subjectAltName = @alt_names

[alt_names]
IP.1 = 127.0.0.1
IP.2 = ::1
DNS.1 = localhost

but generated certificate didn't contain SAN.

However, self-signed certificate produced by the command below contains SAN:

openssl req -new -x509 -sha256 -days 3650 -config ssl.conf -key ssl.key -out ssl.crt
Improve this question
5
  • 3
    Another approach is to use -extfile and if sectioned -extensions on x509 -req to add SAN or other extensions to the cert without (instead of) putting them in the CSR. Though this may be less convenient if you want to reuse the CSR. – dave_thompson_085 Apr 23 '17 at 6:53
  • @dave_thompson_085 thank you. That's what I need. Don't be shy to create an answer. I'll accept it. – dizel3d Apr 23 '17 at 8:04
  • Can you adjust the title, it is not related to CA keys: How to generate SSL certificate having SAN entries? – eckes Apr 23 '17 at 15:38
  • 1
    @eckes, adjusted. – dizel3d Apr 23 '17 at 18:24
  • In the end, I found an example of how it's done here. – Lloyd Jun 16 '17 at 12:05
3
  1. My CSR didn't contain SAN. Extensions should be specified in req_extensions instead of x509_extensions.
  2. There is a bug in x509 command:

    Extensions in certificates are not transferred to certificate requests and vice versa.

So I solved my problem with ca command:

  1. Created empty ca/newcerts folder and empty ca/index.txt file.

  2. Edited ssl.conf:

    [ca]
default_ca = CA_default

[CA_default]
dir = ./ca
database = $dir/index.txt
new_certs_dir = $dir/newcerts
serial = $dir/serial
private_key = ./root.key
certificate = ./root.crt
default_days = 3650
default_md = sha256
policy = policy_anything
copy_extensions = copyall

[policy_anything]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

[req]
prompt = no
distinguished_name = req_distinguished_name
req_extensions = v3_ca

[req_distinguished_name]
CN = 127.0.0.1

[v3_ca]
subjectAltName = @alt_names

[alt_names]
IP.1 = 127.0.0.1
IP.2 = ::1
DNS.1 = localhost

  3. Ran commands:

    openssl genrsa -out ssl.key 2048
openssl req -new -config ssl.conf -key ssl.key -out ssl.csr
openssl ca -config ssl.conf -create_serial -batch -in ssl.csr -out ssl.crt
Improve this answer
1
  • Is there an easy way to generate the config from the csr? – RobAu Aug 17 '18 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.