4

I have a pair of Root CA keys. How to issue a new SSL certificate with SAN (Subject Alternative Name) extension? I tried this

openssl genrsa -out ssl.key 2048
openssl req -new -config ssl.conf -key ssl.key -out ssl.csr
openssl x509 -req -sha256 -days 3650 -CAcreateserial -CAkey root.key -CA root.crt -in ssl.csr -out ssl.crt

ssl.conf:

[req]
prompt = no
distinguished_name = req_distinguished_name
x509_extensions = v3_ca

[req_distinguished_name]
CN = 127.0.0.1

[v3_ca]
subjectAltName = @alt_names

[alt_names]
IP.1 = 127.0.0.1
IP.2 = ::1
DNS.1 = localhost

but generated certificate didn't contain SAN.

However, self-signed certificate produced by the command below contains SAN:

openssl req -new -x509 -sha256 -days 3650 -config ssl.conf -key ssl.key -out ssl.crt
  • 3
    Another approach is to use -extfile and if sectioned -extensions on x509 -req to add SAN or other extensions to the cert without (instead of) putting them in the CSR. Though this may be less convenient if you want to reuse the CSR. – dave_thompson_085 Apr 23 '17 at 6:53
  • @dave_thompson_085 thank you. That's what I need. Don't be shy to create an answer. I'll accept it. – dizel3d Apr 23 '17 at 8:04
  • Can you adjust the title, it is not related to CA keys: How to generate SSL certificate having SAN entries? – eckes Apr 23 '17 at 15:38
  • 1
    @eckes, adjusted. – dizel3d Apr 23 '17 at 18:24
  • In the end, I found an example of how it's done here. – Lloyd Jun 16 '17 at 12:05
2
  1. My CSR didn't contain SAN. Extensions should be specified in req_extensions instead of x509_extensions.
  2. There is a bug in x509 command:

    Extensions in certificates are not transferred to certificate requests and vice versa.

So I solved my problem with ca command:

  1. Created empty ca/newcerts folder and empty ca/index.txt file.
  2. Edited ssl.conf:

    [ca]
    default_ca = CA_default
    
    [CA_default]
    dir = ./ca
    database = $dir/index.txt
    new_certs_dir = $dir/newcerts
    serial = $dir/serial
    private_key = ./root.key
    certificate = ./root.crt
    default_days = 3650
    default_md = sha256
    policy = policy_anything
    copy_extensions = copyall
    
    [policy_anything]
    countryName = optional
    stateOrProvinceName = optional
    localityName = optional
    organizationName = optional
    organizationalUnitName = optional
    commonName = supplied
    emailAddress = optional
    
    [req]
    prompt = no
    distinguished_name = req_distinguished_name
    req_extensions = v3_ca
    
    [req_distinguished_name]
    CN = 127.0.0.1
    
    [v3_ca]
    subjectAltName = @alt_names
    
    [alt_names]
    IP.1 = 127.0.0.1
    IP.2 = ::1
    DNS.1 = localhost
    
  3. Ran commands:

    openssl genrsa -out ssl.key 2048
    openssl req -new -config ssl.conf -key ssl.key -out ssl.csr
    openssl ca -config ssl.conf -create_serial -batch -in ssl.csr -out ssl.crt
    
  • Is there an easy way to generate the config from the csr? – RobAu Aug 17 '18 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.