Re: subjectAltName removed from CSR when signing

2012-01-04 Thread Greger Lundin
Den 4 jan 2012 17:44 skrev "Mick" : > > On Wednesday 04 Jan 2012 13:40:12 you wrote: > > On Wed, Jan 4, 2012 at 1:57 PM, Mick wrote: > > > On Wednesday 04 Jan 2012 12:33:06 you wrote: > > >> Hi, > > >> > > >> I have some firewalls that puts an subjectAltName X509v3 attribute > > >> into the CSR, b

Re: subjectAltName removed from CSR when signing

2012-01-04 Thread Mick
On Wednesday 04 Jan 2012 13:40:12 you wrote: > On Wed, Jan 4, 2012 at 1:57 PM, Mick wrote: > > On Wednesday 04 Jan 2012 12:33:06 you wrote: > >> Hi, > >> > >> I have some firewalls that puts an subjectAltName X509v3 attribute > >> into the CSR, but when I sign them with my openssl CA, it just thr

Re: subjectAltName removed from CSR when signing

2012-01-04 Thread Greger Lundin
On Wed, Jan 4, 2012 at 1:57 PM, Mick wrote: > On Wednesday 04 Jan 2012 12:33:06 you wrote: >> Hi, >> >> I have some firewalls that puts an subjectAltName X509v3 attribute >> into the CSR, but when I sign them with my openssl CA, it just throws >> that attribute away. VPN clients later requires the

Re: subjectAltName removed from CSR when signing

2012-01-04 Thread Dr. Stephen Henson
On Wed, Jan 04, 2012, Mick wrote: > On Wednesday 04 Jan 2012 12:33:06 you wrote: > > > I've found many articles how I can add that attribute by using a > > custom config file and the -extfile and -extensions > > parameters. I've used that as a "work around" to get subjectAltName > > into certif

Re: subjectAltName removed from CSR when signing

2012-01-04 Thread Mick
On Wednesday 04 Jan 2012 12:33:06 you wrote: > Hi, > > I have some firewalls that puts an subjectAltName X509v3 attribute > into the CSR, but when I sign them with my openssl CA, it just throws > that attribute away. VPN clients later requires the subjectAltName to > match the host it connects to,

subjectAltName removed from CSR when signing

2012-01-04 Thread Greger Lundin
Hi, I have some firewalls that puts an subjectAltName X509v3 attribute into the CSR, but when I sign them with my openssl CA, it just throws that attribute away. VPN clients later requires the subjectAltName to match the host it connects to, hence it must be present. I've found many articles how