I'm having a heck of a time getting the SAN into a server's CSR.
I believe the relevant sections are:
[ req ]
req_extensions = server_req_extensions
[ server_req_extensions ]
subjectKeyIdentifier = hash
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alternate_names
nsComment = "OpenSSL Generated Certificate"
[ alternate_names ]
DNS.1 = example.com
DNS.2 = www.example.com
DNS.3 = mail.example.com
DNS.4 = ftp.example.com
I then generate the CSR with `openssl req -config openssl-server.cnf
-newkey rsa:2048 -sha256 -nodes -out serverreq.csr -outform PEM`
However, when I dump the CSR with `openssl req -text -noout -verify
-in servercert.csr`, I see the SANs are not present:
$ openssl req -text -noout -verify -in servercert.csr
verify OK
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=XX, ST=XX, L=XX, CN=Test Server/[email protected]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:d5:6f:24:e9:70:5d:40:47:73:e0:b8:f3:4d:48:
...
b9:19:d1:6b:92:2f:ad:1e:bd:ca:12:86:08:3d:41:
f3:03
Exponent: 65537 (0x10001)
Attributes:
a0:00
Signature Algorithm: sha256WithRSAEncryption
74:98:1d:10:23:2b:73:29:f3:dd:3d:76:c2:69:08:5a:5e:d2:
...
39:06:e0:eb
I tried adding `subjectAltName=dns:copy`, but that resulted in an
error (so I know the section is being read):
Error Loading extension section server_extensions
140490047387304:error:22075075:X509 V3
routines:v2i_GENERAL_NAME_ex:unsupported option:v3_alt.c:557:name=dns
140490047387304:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error
in extension:v3_conf.c:93:name=subjectAltName, value=dns:copy
Any ideas what I'm doing wrong?
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
