openssl : generate a self signed certificate which supports subject alternative name

Here are logs when generating a self signed certificate which supports subject alternative name (SAN)

# dpkg -l openssl ii  openssl            1.0.1f-1ubuntu amd64          Secure Sockets Layer toolkit - cryptograp

At first, edit openssl.cnf.

Where is openssl.cnf ?

# locate openssl.cnf /etc/ssl/openssl.cnf /usr/lib/ssl/openssl.cnf

Change the directory.

# cd /etc/ssl/ # cp openssl.cnf openssl.cnf.org

edit openssl.cnf

[ req ] default_bits            = 2048 default_keyfile         = privkey.pem distinguished_name      = req_distinguished_name req_extensions = v3_req attributes              = req_attributes

edit openssl.cnf

[ v3_req ] # Extensions to add to a certificate request basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [alt_names] DNS.1 = www.foo.com DNS.2 = www.bar.org DNS.3 = www.foobar.net

generate a private key

# openssl genrsa -out ssl_san.key 2048 Generating RSA private key, 2048 bit long modulus ..................................................................................+++ .................+++ e is 65537 (0x10001)

generate the CSR.

specify “www.foo.com” as common name

# openssl req -new -out ssl_san.csr -key ssl_san.key -config /etc/ssl/openssl.cnf # openssl req -new -out ssl_san.csr -key ssl_san.key -config /etc/ssl/openssl.cnf You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: State or Province Name (full name) [Some-State]: Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]: Organizational Unit Name (eg, section) []: Common Name (e.g. server FQDN or YOUR name) []:www.foo.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:

dump the CSR info.

# openssl req -text -noout -in ssl_san.csr Certificate Request:    Data:        Version: 0 (0x0)        Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=www.foo.com        Attributes:        Requested Extensions:            X509v3 Basic Constraints:                CA:FALSE            X509v3 Key Usage:                Digital Signature, Non Repudiation, Key Encipherment            X509v3 Subject Alternative Name:                DNS:www.foo.com, DNS:www.bar.org, DNS:www.foobar.net

create the self-signed certificate.

# openssl x509 -req -days 365 -in ssl_san.csr -signkey ssl_san.key -out ssl_san.crt -extensions v3_req -extfile /etc/ssl/openssl.cnf Signature ok subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd/CN=www.foo.com Getting Private key

dump the cert info.

# openssl x509 -text -in ssl_san.crt # openssl x509 -text -in ssl_san.crt Certificate:    Data:        Version: 3 (0x2)        Serial Number: 14707573325970862199 (0xcc1bcc041280f077)    Signature Algorithm: sha256WithRSAEncryption        Issuer: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=www.foo.com        X509v3 extensions:            X509v3 Basic Constraints:                CA:FALSE            X509v3 Key Usage:                Digital Signature, Non Repudiation, Key Encipherment            X509v3 Subject Alternative Name:                DNS:www.foo.com, DNS:www.bar.org, DNS:www.foobar.net