OpenSSL Does not Create Subject Alternative Name (SAN)

Scarnet

2/5/24, 12:55 PM

I have been trying to create a self-signed certificate with subject alternative name; however, although the cretifcate was created successfully, SAN was not added to its details.

Here's the command I used to create singing request.

openssl req -newkey rsa:2048 -nodes -sha256 -keyout server.key -out server.csr -config openssl-san.cnf

And here's the content of the configuration file.

[ req ]
default_bits           = 2048
distinguished_name     = req_distinguished_name
req_extensions         = req_ext

[ req_distinguished_name ]
countryName            = Country Name (2 letter code)
stateOrProvinceName    = State or Province Name (full name)
localityName           = Locality Name (eg, city)
organizationName       = Organization Name (eg, company)
commonName             = Common Name (e.g. server FQDN or YOUR name)

# Optionally, specify some defaults.
countryName_default           = **
stateOrProvinceName_default   = ****
localityName_default           = ****
0.organizationName_default     = ******
organizationalUnitName_default = **
emailAddress_default           = *********

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
DNS.0   = localhost

Certificate details

What am I doing wrong here?

Please note that I'm a software developer so creating certificates are not my typical thing

1179

1 + 1

ssl

openssl

ssl-certificate

subject-alternative-names

Steffen Ullrich

2/5/24, 1:33 PM

You only show how you create the CSR - which has the SAN inside. You don't show how you create the certificate, only complain that the certificate (which was created in an undocumented way) does not have the SAN inside. This means you likely don't include the SAN in the certificate - but nothing is known here. Note that SAN are not guaranteed to be copied from the CSR when creating a certificate.

Score:0

Server

garethTheRed

2/5/24, 5:37 PM

A minimal config (minimal.cnf) which will give you a self-signed is:

prompt             = no
distinguished_name = req_dn
x509_extensions = x509_ext

[ req_dn ]
commonName         = Example Web Service

[ x509_ext ]
subjectAltName = @alt_names
# You may need the next line to stop Firefox complaining:
basicConstraints = critical; CA:TRUE
 
[alt_names]
DNS.1 = www.example.com
DNS.2 = example.com

Create the self-signed certificate with:

openssl req -x509 -new -newkey rsa:2048 -nodes -days 720 -keyout selfsigned.key -out selfsigned.cer -config minimal.cnf

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: OpenSSL Does not Create Subject Alternative Name (SAN)

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.