How can I create a certificate with a Subject Alternate Name from my self-signed root certificate?

Y

Yakov Kravtsov2017-11-03 18:18:12

OpenSSL

Yakov Kravtsov, 2017-11-03 18:18:12

Good afternoon!
I've been trying to create a bundle for a day now: my self-signed root certificate + a certain number of certificates signed by this CA (at the same time, each certificate must have the Subject Alternate Name property filled in).
Create - a self-signed certificate with the presence of SAN - is elementary. There are a lot of examples on the Internet in 1 line.
Create - a self-signed certificate, which will be further CA - is also elementary.
Then problems begin...
1) To create a CSR with the presence of the SAN property - I suffered for a long time - but I kind of did it.
2) Sign this CSR with CA... Here is where it hangs. No matter what I do, the properties disappear or errors occur during generation.
To specify the SAN, an external config is used. For example this (found on the Internet).

[ req ]
default_bits       = 2048
distinguished_name = req_distinguished_name
req_extensions     = req_ext
[ req_distinguished_name ]
countryName                 = Country Name (2 letter code)
stateOrProvinceName         = State or Province Name (full name)
localityName               = Locality Name (eg, city)
organizationName           = Organization Name (eg, company)
commonName                 = bestflare.com
[ req_ext ]
subjectAltName = @alt_names
[alt_names]
DNS.1   = bestflare.com
DNS.2   = usefulread.com
DNS.3   = chandank.com

CSR turned out like this

How can I sign this CSR with my CA without losing properties?

Reply

Answer the question

In order to leave comments, you need to log in

1 answer(s)

K

Keffer, 2018-07-12
@Keffer

And what errors fly out when signing?