I generated CA, with this article, and stored it in my machine. Now, I want to create a server certificate and use it in my webserver. This is my generate server certificate code:

# USE: ./build.sh <CERTNAME> <EXPR_DAYS>

openssl genrsa -out $1.key 2048

openssl req -new -key $1.key -out $1.csr -config ssl.config

openssl x509 -req -in $1.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out $1.pem -days $2 -sha256

This code is generating the certificate but it missing the alternate names as specified in my ssl.config file:

[ req ]
default_bits        = 2048
default_keyfile     = server-key.pem
distinguished_name  = subject
req_extensions      = extensions
x509_extensions     = extensions
string_mask         = utf8only
prompt              = no

[ subject ]
countryName         = US
stateOrProvinceName = NY
localityName        = New York
organizationName    = Company
commonName          = API
emailAddress        = test@example.com

[ extensions ]
basicConstraints            = CA:TRUE
keyUsage                    = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectKeyIdentifier        = hash
extendedKeyUsage            = serverAuth
subjectAltName              = @alternate_names

[ alternate_names ]

To confirm that alternative name is missing, I run:

$ openssl x509 -in cert.pem -noout -text
        Version: 1 (0x0)
        Serial Number:
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Some-State, O = Company
            Not Before: Oct 13 10:38:26 2019 GMT
            Not After : Feb 27 10:38:26 2047 GMT
        Subject: C = US, ST = NY, L = New York, O = Company, CN = API, emailAddress = test@example.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Exponent: XXXX (XXX)
    Signature Algorithm: sha256WithRSAEncryption

As you can see, the alternative name section is missing. I expected to see:

X509v3 Subject Alternative Name: IP:, IP:

What I'm doing wrong?


Found the problem.


openssl x509 -req -in $1.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out $1.pem -days $2 -sha256

became this:

openssl x509 -req -in $1.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out $1.pem -days $2 -sha256 -extensions v3_req -extfile ssl.config

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.