Multi Domain CSR (SAN) - Revision history

Ledhed at 20:36, 13 October 2017

2017-10-13T20:36:36Z

Ledhed at 03:03, 31 March 2016

2016-03-31T03:03:19Z

Ledhed at 02:49, 31 March 2016

2016-03-31T02:49:37Z

Ledhed at 02:49, 31 March 2016

2016-03-31T02:49:28Z

Ledhed at 02:47, 31 March 2016

2016-03-31T02:47:33Z

Ledhed: Created page with "== Overview == == Create a Key == Create a server key in pem format: openssl genrsa -out server.key 2048 == Create a Config File == Normally when you generate a CSR you a..."

2016-03-31T02:42:13Z

Created page with "== Overview == == Create a Key == Create a server key in pem format: openssl genrsa -out server.key 2048 == Create a Config File == Normally when you generate a CSR you a..."

New page

== Overview ==

== Create a Key ==
Create a server key in pem format:
openssl genrsa -out server.key 2048

== Create a Config File ==
Normally when you generate a CSR you are prompted with several questions like Country, State, yadda yadda. You can create a config file which pre-populates these fields. In this case we will use this config file to add in the Subject Alternative Names (SAN).

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req

[req_distinguished_name]
countryName = Country Name (2 letter code)
countryName_default = US
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = California
localityName = Locality Name (eg, city)
localityName_default = Sacramento
organizationalUnitName = Organizational Unit Name (eg, section)
commonName = Common Name (eg, YOUR name)
commonName_max = 64
emailAddress = Email Address
emailAddress_max = 40

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = www.yourdomain.com
DNS.2 = webmail.yourdomain.com
DNS.3 = www.otherdomain.com

You can modify the above settings to suit your needs. Most importantly is the ''[alt_names]'' section. This is where we add the other domains (SAN). You will be able to override the other info when creating the CSR in the next section.
<br>
'''Note: that when prompted for ''commonName:'' to enter your primary domain name.'''

== Create a CSR ==
Create a server "Certificate Signing Request" (CSR):
openssl req -new -key server.key -out server.csr -config server.conf

== Reference ==
http://blog.danmassey.net/?p=407

[[Category:OpenSSL]]

@@ Line 52: / Line 52: @@
   openssl req -text -noout -in server.csr
 You should see your SAN's in the output under the ''X509v3 Subhect Alternative Name'' section.
 == Reference ==

← Older revision		Revision as of 02:49, 31 March 2016
Line 49:		Line 49:


−		+	== Checking the CSR ==
		+	openssl req -text -noout -in server.csr
		+	You should see your SAN's in the output under the ''X509v3 Subhect Alternative Name'' section.

	== Reference ==		== Reference ==

@@ Line 22: / Line 22: @@
   localityName = Locality Name (eg, city)
   localityName_default = Sacramento
   organizationalUnitName = Organizational Unit Name (eg, section)
   commonName = Common Name (eg, YOUR name)
   commonName_max = 64
   emailAddress = Email Address
   emailAddress_max = 40
@@ Line 37: / Line 41: @@
   DNS.2 = webmail.yourdomain.com
   DNS.3 = www.otherdomain.com
 You can modify the above settings to suit your needs. Most importantly is the ''[alt_names]'' section. This is where we add the other domains (SAN). You will be able to override the other info when creating the CSR in the next section.

@@ Line 56: / Line 56: @@
 == Reference ==
 http://blog.danmassey.net/?p=407
 [[Category:OpenSSL]]

@@ Line 1: / Line 1: @@
 == Overview ==
@@ Line 38: / Line 39: @@
 You can modify the above settings to suit your needs. Most importantly is the ''[alt_names]'' section. This is where we add the other domains (SAN). You will be able to override the other info when creating the CSR in the next section.
-<br>
-'''Note: that when prompted for ''commonName:'' to enter your primary domain name.'''
 == Create a CSR ==
 Create a server "Certificate Signing Request" (CSR):
   openssl req -new -key server.key -out server.csr -config server.conf
+'''Note: When prompted for ''commonName:'' to enter your primary domain name.'''
+Example:
+ Common Name (eg, YOUR name) []:yourdomain.com
-−