I have a pair of Root CA keys. How to issue a new SSL certificate with SAN (Subject Alternative Name) extension? I tried this
openssl genrsa -out ssl.key 2048
openssl req -new -config ssl.conf -key ssl.key -out ssl.csr
openssl x509 -req -sha256 -days 3650 -CAcreateserial -CAkey root.key -CA root.crt -in ssl.csr -out ssl.crt
ssl.conf:
[req]
prompt = no
distinguished_name = req_distinguished_name
x509_extensions = v3_ca
[req_distinguished_name]
CN = 127.0.0.1
[v3_ca]
subjectAltName = @alt_names
[alt_names]
IP.1 = 127.0.0.1
IP.2 = ::1
DNS.1 = localhost
but generated certificate didn't contain SAN.
However, self-signed certificate produced by the command below contains SAN:
openssl req -new -x509 -sha256 -days 3650 -config ssl.conf -key ssl.key -out ssl.crt
-extfile
and if sectioned-extensions
onx509 -req
to add SAN or other extensions to the cert without (instead of) putting them in the CSR. Though this may be less convenient if you want to reuse the CSR.