How to issue SSL certificate with SAN extension?

Question

I have a pair of Root CA keys. How to issue a new SSL certificate with SAN (Subject Alternative Name) extension? I tried this

openssl genrsa -out ssl.key 2048
openssl req -new -config ssl.conf -key ssl.key -out ssl.csr
openssl x509 -req -sha256 -days 3650 -CAcreateserial -CAkey root.key -CA root.crt -in ssl.csr -out ssl.crt

ssl.conf:

[req]
prompt = no
distinguished_name = req_distinguished_name
x509_extensions = v3_ca

[req_distinguished_name]
CN = 127.0.0.1

[v3_ca]
subjectAltName = @alt_names

[alt_names]
IP.1 = 127.0.0.1
IP.2 = ::1
DNS.1 = localhost

but generated certificate didn't contain SAN.

However, self-signed certificate produced by the command below contains SAN:

openssl req -new -x509 -sha256 -days 3650 -config ssl.conf -key ssl.key -out ssl.crt

Answer 1

1. My CSR didn't contain SAN. Extensions should be specified in req_extensions instead of x509_extensions.
2. There is a bug in x509 command:

   Extensions in certificates are not transferred to certificate requests and vice versa.

So I solved my problem with ca command:

1. Created empty ca/newcerts folder and empty ca/index.txt file.

2. Edited ssl.conf:

   [ca]
   default_ca = CA_default
   
   [CA_default]
   dir = ./ca
   database = $dir/index.txt
   new_certs_dir = $dir/newcerts
   serial = $dir/serial
   private_key = ./root.key
   certificate = ./root.crt
   default_days = 3650
   default_md = sha256
   policy = policy_anything
   copy_extensions = copyall
   
   [policy_anything]
   countryName = optional
   stateOrProvinceName = optional
   localityName = optional
   organizationName = optional
   organizationalUnitName = optional
   commonName = supplied
   emailAddress = optional
   
   [req]
   prompt = no
   distinguished_name = req_distinguished_name
   req_extensions = v3_ca
   
   [req_distinguished_name]
   CN = 127.0.0.1
   
   [v3_ca]
   subjectAltName = @alt_names
   
   [alt_names]
   IP.1 = 127.0.0.1
   IP.2 = ::1
   DNS.1 = localhost
   

3. Ran commands:

   openssl genrsa -out ssl.key 2048
   openssl req -new -config ssl.conf -key ssl.key -out ssl.csr
   openssl ca -config ssl.conf -create_serial -batch -in ssl.csr -out ssl.crt