Subject Alernative names with Openssl

In this post we will see, how can we create CSR with SAN, which stands for Subject Alternative Names and obviously using openssl command.

For those who do not know what is SAN, let me cover this in short.There are 3 main types of SSL

•  Standard SSL  :- Used for securing single domain. like www.domain.com, i,e one domain -- one certificate
• Wild card SSL : - Used for securing multiple sub-domains like home.domain.com office.domain.com in single certificate, i.e multiple subdomain --- single certificate
• Multi-domain SSL : -- Used for securing multiple domains, like www.domain.com, www.home.com, www.office.net, i,e multiple domains --- single certificate.

So, SAN comes under multiple domains certificate category.

When you purchase a multi-domain certificate from certificate issuing authority ,they give you options of defining SAN along with primary domain.

So, Here we are discussing about how to create CSR(which is required while purchasing the certificate) with SAN itself.And why we are doing this ??

Answer is now a days we see,some Certificate issuing authority , does not include SANs when we purchased a certificate from them,like if I purchased certificate for www.domain.com, the certificate will not include domain.com, which some times creates issues for getting PCI  (Product card industry) certificate for E-commerce sites.

PCI is getting Necessary for E-commerce site now a-days .Lets see then,how to create CSR with SAN

Hopefully you have Linux box with you, with root permission. then do the following

Step 1 : 

Add below lines in file if its not present.
vi /etc/pki/tls/openssl.cnf

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req


###Now we'll go own down to the v3_req section and make sure that it includes the following:

[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names  --->>>> This is IMP, if not present , then add this line.

##Then add below line in same file under [ v3_req ]

[alt_names]
DNS.1 = kb.domain.com
DNS.2 = home.domain.net
DNS.3 = systems.domain.com

## ---- > Denotes comments here.

Step 2 :

save the file.

Step 3 :  

Run below command on the linux terminal,replacing the contents of the commands as per your need

openssl req -new -newkey rsa:2048 -nodes -sha256 -out domain.csr -keyout domain.key -subj "/C=us/ST=Florida/L=Jacksonville/O=Company/OU=IT Department/CN=www.domain.com" -config /etc/pki/tls/openssl.cnf

Above command helps you remove some vulnerabilities you might get from PCI Vendor related to SSL Certificate.

Share on Google Plus

About Er.Susheel

This is a short description in the author block about the author. You edit it by entering text in the "Biographical Info" field in the user admin panel.