OpenSSL CSR with Subject Alternative Name

EddieJennings

https://geekflare.com/san-ssl-certificate/

This worked beautifully for me. Chrome 58 gripes about a SAN not being present, and ye ole way I'd use to generate a csr didn't prompt you for any kind of SAN. Granted this won't prompt you, rather you'll simply configure what you want.

Ye ole way (doesn't produce any kind of SAN) = openssl req -new newcsr.req -newkey rsa:2048 -nodes -keyout newkey.key

I'm sure there are different ways (and likely better) to achieve this, but the above link worked for me.

Edited for clarity.

JaredBusch

@EddieJennings said in OpenSSL CSR with Subject Alternative Name:

https://geekflare.com/san-ssl-certificate/

This worked beautifully for me. Chrome 58 gripes about a SAN not being present, and ye ole way I'd use to generate a csr didn't prompt you for any kind of SAN. Granted this won't prompt you, rather you'll simply configure what you want.

Ye ole way = openssl req -new newcsr.req -newkey rsa:2048 -nodes -keyout newkey.key

I'm sure there are different ways (and likely better) to achieve this, but this worked for me.

That is not adding a SAN, that is making a new cert with a new private key.

EddieJennings

@JaredBusch Correct. The "ye olde way" is how I've typically made a CSR and private key. The link I included talks about making a configuration file, which allows you to include SAN in your CSR.

JaredBusch

@EddieJennings said in OpenSSL CSR with Subject Alternative Name:

@JaredBusch Correct. The "ye olde way" is how I've typically made a CSR and private key. The link I included talks about making a configuration file, which allows you to include SAN in your CSR.

Ah, did not read the link. Yes, using a config file is the only method to get any SAN on a cert with OpenSSL.

EddieJennings

@JaredBusch said in OpenSSL CSR with Subject Alternative Name:

@EddieJennings said in OpenSSL CSR with Subject Alternative Name:

@JaredBusch Correct. The "ye olde way" is how I've typically made a CSR and private key. The link I included talks about making a configuration file, which allows you to include SAN in your CSR.

Ah, did not read the link. Yes, using a config file is the only method to get any SAN on a cert with OpenSSL.

And after re-reading my post, I realized how terrible it was :(. I was hoping to find a one liner kind of thing, but alas. That particular article made it clear how to do it.