Comments for OpenSSL CSR with Alternative Names one-line #1048

phinjensen · 2017-11-11T01:56:52Z

Comments for https://www.endpointdev.com/blog/2014/10/openssl-csr-with-alternative-names-one/
By Emanuele “Lele” Calò

To enter a comment:

Log in to GitHub
Leave a comment on this issue.

phinjensen · 2017-11-11T01:56:55Z

original author: Jon Jensen
date: 2014-10-30T23:47:10-04:00

Thanks, Lele. Great to have a single command for that.

One thing I'm curious about: I believe the RFCs state that if you use a Subject Alternative Name, you should supply all names as SANs, and the CN can be ignored by clients. If I understand correctly, that means you should list e.g. www.endpoint.com as the CN, and both www.endpoint.com and bare endpoint.com as SANs.

Can you confirm or deny that?

phinjensen · 2017-11-11T01:56:58Z

original author: Emanuele 'Lele' Calo'
date: 2014-11-28T17:38:57-05:00

After some investigation I finally found a proper answer.

As can be read here, it seems that "some browsers" (yes, IE) may refer to this RFC strictly enough that if they found a SAN field they won't consider the CN field and only use the domains found in the SANs.

While the original "older" RFC didn't specifically endorsed nor encouraged that behavior, with the new RFC there was more confusion on how to read that part so some browser went that way.

The final answer is: since it's never a problem to have one domain in both fields (CN and SAN) but it can be a problem to have the main domain only in the CN when using SANs, it's better to have all domains present in both fields.

Since the CN only supports one domain, it's common practice to put the main domain there, and then repeat it in the SAN field along with all the additional ones.

phinjensen · 2017-11-11T01:57:00Z

original author: Deikensentsu
date: 2015-01-20T11:59:32-05:00

This does not correctly generate the x509 certificate with the v3 extensions required for proper compliance with the RFC spec.

This can be verified by generating a certificate and then doing an 'openssl req -in yourfile.csr -noout -text' and looking for the v3 information.

I'm still interested in finding a one-liner, but so far I've had to build a openssl.cnf according to this other blog post and passed it in. http://apetec.com/support/GenerateSAN-CSR.htm

phinjensen · 2017-11-11T01:57:03Z

original author: Emanuele 'Lele' Calo'
date: 2015-01-20T12:05:00-05:00

@Deikensentsu That's true.

Anyway I found that most certificate authorities are happy with the CSR generate that way and will create a certificate securing the right domains (NameCheap, GoDaddy, GeoTrust, ecc..)

Anyway thanks for your input, I'll add a line in the post text.

Have a great day.

phinjensen · 2017-11-11T01:57:05Z

original author: sushil rangari
date: 2015-01-21T16:05:27-05:00

Hi ,

your command is not working for me, it giving me error like below

Error opening Private Key endpoint.com.key
5133:error:02001002:system library:fopen:No such file or directory:bss_file.c:352:fopen('endpoint.com.key','r')
5133:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354:
unable to load Private Key

when I remove endpoint.com.key from the command ,the csr which gets genrated do not have SAN in it, this is what I got in CSR

on decoding above csr its giving me like below

Email: a@gmail.com/subjectAltName=DNS.1=endpoint.com

Please suggest

phinjensen · 2017-11-11T01:57:08Z

original author: Emanuele 'Lele' Calo'
date: 2015-01-23T10:56:17-05:00

@sushil_rangari this post assumed readers to have a solid grasp of certificate creation/management basics. Before jumping on SANs you should probably practice more on basic certificates.
Specifically all the parameters should be customized to your specific situation.

phinjensen · 2017-11-11T01:57:10Z

original author: sushil rangari
date: 2015-01-23T12:03:24-05:00

Hello Emanuele,

Thanks for replying back. Yes i do have some basic knowledge of Certificate Generations.

I replaced the contents of the your command as my need, but the desired CSR was not generated which i wanted. like specially for SAN

I have added www.domain.com as CN and under subjectAltName=DNS.1=domain.com

but the got SAN under email section

Email:name@gmail.com/subjectAltName=DNS.1=domain.com

am I doing some thing wrong ? do I need to made changes in openssl conf file as well ?

Please suggest .it will be helpful

Thanks
Sushil R

phinjensen · 2017-11-11T01:57:13Z

original author: Emanuele 'Lele' Calo'
date: 2015-01-23T12:18:51-05:00

@sushil_rangari it seems that something could have been wrong in the command you used to generate the certificate. In order to be of any help I'd nee to see the steps you took to create the certificate. Please create a pastebin and I'll be happy to take a look and try to help.

phinjensen · 2017-11-11T01:57:15Z

original author: sushil rangari
date: 2015-01-23T12:55:21-05:00

Hello Emanuele,

here is the commands which I am running

[root@master ~]# openssl req -new -sha256 -nodes -subj '/C=US/ST=New York/L=New York/O=IT/OU=Hosting Team/CN=www.domain.com/emailAddress=sushil.rangari84@gmail.com/subjectAltName=domain.com' > www.domain.com.csr
Generating a 1024 bit RSA private key
...............++++++
.........................++++++
writing new private key to 'privkey.pem'

[root@master ~]# cat www.domain.com.csr
-----BEGIN CERTIFICATE REQUEST-----
MIIB8TCCAVoCAQAwgbAxCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhOZXcgWW9yazER
MA8GA1UEBxMITmV3IFlvcmsxCzAJBgNVBAoTAklUMRUwEwYDVQQLEwxIb3N0aW5n
IFRlYW0xFzAVBgNVBAMTDnd3dy5kb21haW4uY29tMSkwJwYJKoZIhvcNAQkBFhpz
dXNoaWwucmFuZ2FyaTg0QGdtYWlsLmNvbTETMBEGA1UdERMKZG9tYWluLmNvbTCB
nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1vHtUOHwPwajeEcXURRXzcs6aVre
vdKoG1M7FM8k2ryhtBaK0dLSbqyCb5huak7g9vnPG9IY8GIKyYHYUvN//QnPUomU
1zso2RJVKw0Bykkf4rRZSxkHDZsGLBNnw1Ut40utz92buNNSSWfq8l58kha9v+nH
UqGYB8KWVyns5zECAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4GBAHwqV3SHCVlwRovB
ra7b1SuRi1xXNXT5CT6FJWWVducisA9vxGTQ5pwSpvIexv3kAmv73ofWAyD1HOPM
BpSYv96Yw8PTnDh1Vz7vLMtvk1Ty4Bin4/oWx9p9kY1jj4/HGOmsmp0/yGRcbmhm
0zfR4jjctWE7t/jgwr5+EeJ0okS+
-----END CERTIFICATE REQUEST-----
[root@master ~]# openssl req -text -noout -verify -in www.domain.com.csr
verify OK
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=US, ST=New York, L=New York, O=IT, OU=Hosting Team, CN=www.domain.com/emailAddress=sushil.rangari84@gmail.com/subjectAltName=domain.com
Subject Public Key Info:

Please suggests.

Thanks
Sushil R

phinjensen · 2017-11-11T01:57:18Z

original author: sushil rangari
date: 2015-01-23T13:41:51-05:00

In my previous command I missed DNS.1=

but after adding the result are same

[root@master ~]# openssl req -new -sha256 -nodes -subj '/C=US/ST=New York/L=New York/O=IT/OU=Hosting Team/CN=www.domain.com/emailAddress=sushil.rangari84@gmail.com/subjectAltName=DNS.1=domain.com' > www.domain.com.csr
Generating a 1024 bit RSA private key
....++++++
...........................++++++
writing new private key to 'privkey.pem'

[root@master ~]# openssl req -text -noout -verify -in www.domain.com.csr
verify OK
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=US, ST=New York, L=New York, O=IT, OU=Hosting Team, CN=www.domain.com/emailAddress=sushil.rangari84@gmail.com/subjectAltName=DNS.1=domain.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption

Thanks
Sushil R

phinjensen · 2017-11-11T01:57:20Z

original author: Emanuele 'Lele' Calo'
date: 2015-01-26T10:50:53-05:00

Hi Sushil Rangari,
That behavior you noticed is the same one the other reader noticed in saying that it's not "X509v3 compliant", specifically meaning that the SAN will be part of the subject field instead of having a dedicated field.
As I anticipated, this is not an issue with most certificate provider out there (NameCheap, GeoTrust, GoDaddy) while it may be an issue if you're dealing with software or appliances which needs certificates to be strictly X509v3 compliant.
In that case I suggest using the classical file-based SAN generation approach.

Thank you.

phinjensen · 2017-11-11T01:57:23Z

original author: Michael Roedelbronn
date: 2015-09-22T17:06:21-04:00

Hi, I was wondering how one could use this format and also use a challenge phrase. When I use the syntax given it does not prompt for any further information. Putting /challengePassword=.../ doesn't seem to work.

phinjensen · 2017-11-11T01:57:25Z

original author: Andrew Leahy
date: 2015-10-14T01:46:17-04:00

Hi Lele,

FYI your one liner didn't seem to add the subjectAltName to my CSR when I ran it thru a CSR decoder. But this one-liner did:

openssl req -new -sha256 -key domain.key -subj "/C=US/ST=CA/O=Acme, Inc./CN=example.com" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:example.com,DNS:www.example.com")) -out domain.csr

Cheers, Andrew | Western Sydney Uni

phinjensen · 2017-11-11T01:57:28Z

original author: Lyas Spiehler
date: 2015-10-27T13:27:01-04:00

I just developed a web based tool that will generate this command for you and display the output. http://kernelmanic.com/certificate-request-generator-with-multiple-common-names-and-subject-alternative-names/

phinjensen · 2017-11-11T01:57:30Z

original author: Lyas Spiehler
date: 2016-03-22T08:44:11-04:00

I've updated my web based OpenSSL tool to automatically generate this command. https://certificatetools.com/

phinjensen · 2017-11-11T01:57:33Z

original author: Starbeamrainbowlabs -
date: 2016-06-28T04:28:35-04:00

Thanks - this post is really helpful. I would say though that using "New York" as an example in the openssl command itself is very confusing - I can't tell the difference between the different fields. Perhaps it should be changed to something else?

phinjensen · 2017-11-11T01:57:35Z

original author: Jake
date: 2017-02-09T14:00:31-05:00

Please update your post or delete it.

phinjensen · 2017-11-11T01:57:38Z

original author: satish rao
date: 2017-02-14T13:46:16-05:00

Hi,
I am using the below command :

openssl req -config openssl.cnf -new -key ./private/radagast8.key -sha256 -nodes -out radagast9.csr -subj '/C=US/ST=Georgia/L=Dulut/O=Ericsson/OU=SV/CN=mdms-settings/
emailAddress=satish.anupindi.rao@ericsson.com/
subjectAltName=DNS.1=mdms-settings,
DNS.2=httpna,
IP.1=10.116.4.195,
IP.2=10.116.4.143'

But I get an error with

Subject Attribute
emailAddress has no known NID, skipped
Subject Attribute
subjectAltName has no known NID, skipped

What did I do wrong ?

phinjensen · 2017-11-11T01:57:41Z

original author: Emanuele 'Lele' Calo'
date: 2017-02-16T13:13:08-05:00

I finally found some time to answer all the questions, doubts, hints and concerns above.

Thank you all for your hints, ideas and comments.

phinjensen · 2017-11-11T01:57:43Z

original author: Phillip Odam
date: 2017-05-12T12:50:02-04:00

How about just...

./generateCSR.sh US 'New York' Rochester 'End Point' 'Testing Domain' your-administrative-address@your-awesome-existing-domain.com your-new-domain.com

and if you want to make the argument handling flexible see http://wiki.bash-hackers.org/howto/getopts_tutorial

You may not want the argument defaults that I've set in generateCSR.sh but instead make at least some arguments required

And for the generateCSR.sh...

#!/bin/sh

CSR_DETAILS=$(mktemp)

cat > ${CSR_DETAILS} <<-EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
C=${ENV::COUNTRY}
ST=${ENV::STATE}
L=${ENV::LOCATION}
O=${ENV::ORGANIZATION}
OU=${ENV::ORGANIZATION_UNIT}
emailAddress=${ENV::EMAIL}
CN=www.${ENV::DOMAIN}

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = ${ENV::DOMAIN}
DNS.2 = www.${ENV::DOMAIN}
EOF

export COUNTRY=${1:-US}
export STATE=${2:-New York}
export LOCATION=${3:-Rochester}
export ORGANIZATION=${4:-End Point}
export ORGANIZATION_UNIT=${5:-Testing Domain}
export EMAIL=${6:-your-administrative-address@your-awesome-existing-domain.com}
export DOMAIN=${7:-your-new-domain.com}

Let's call openssl now by piping the newly created file in

openssl req -new -sha256 -nodes -out *.${DOMAIN}.csr -newkey rsa:2048 -keyout *.${DOMAIN}.key -config ${CSR_DETAILS}

rm ${CSR_DETAILS}

phinjensen · 2017-11-11T01:57:46Z

original author: vaibhav zirmite
date: 2017-05-17T03:49:37-04:00

Hello,

I have a stupid but basic question about SAN certificates.

Can I use under "alt_names" DNS names of different servers and different domains? for example:
DNS.1 = server1.exampledomain.com
DNS.2 = server2.exampledomain.at
DNS.3 = server3.exampledomain.com
DNS.4 = server4.exampledomain.at

And use generated SAN certificate on all included servers?

BR/ Vaibhav

phinjensen · 2017-11-11T01:57:48Z

original author: Emanuele 'Lele' Calo'
date: 2017-05-17T09:20:01-04:00

Hi vaibhav zirmite,
Yes you definitely can as long as you will be able to validate all of them, not necessarily in one shot.

Hi Phillip Odam,
I'm evaluating adding your hint, in a slightly different version, in the original article. Thanks for taking the time to write it down.

phinjensen · 2017-11-11T01:57:51Z

original author: Phillip Odam
date: 2017-05-18T15:31:24-04:00

Hi Emanuele

No problem, thanks for your write up as it helped with my automating a self-signed root, intermediate, leaf certificate generation.

Phillip

phinjensen · 2017-11-11T01:57:53Z

original author: TODD TRIMMER
date: 2017-06-07T21:23:56-04:00

Thanks for this!

phinjensen · 2017-11-11T01:57:56Z

original author: Manna Anam
date: 2017-08-08T12:12:59-04:00

The code is probably incorrect - it always fails to find distinguished name if not put as the first entry under [req]

phinjensen · 2017-11-11T01:57:58Z

original author: Tom Saleeba
date: 2017-10-16T02:43:04-04:00

Thanks for the useful article. Definitely a time saver.

bish0polis · 2018-09-30T03:47:41Z

-config <( cat csr_details.txt )

why not just -config csr_details.txt ?

aghsmith · 2019-12-18T11:53:58Z

In the command line that inputs the csr details file, you use -sha256. However, you also use
default_md = sha256
in the text of the csr details file.
Is this redundant or are there different things going on?

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments for OpenSSL CSR with Alternative Names one-line #1048

Comments for OpenSSL CSR with Alternative Names one-line #1048

phinjensen commented Nov 11, 2017 •

edited by sethjensen1

Loading

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

bish0polis commented Sep 30, 2018

aghsmith commented Dec 18, 2019

Comments for OpenSSL CSR with Alternative Names one-line #1048

Comments for OpenSSL CSR with Alternative Names one-line #1048

Comments

phinjensen commented Nov 11, 2017 • edited by sethjensen1 Loading

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

Let's call openssl now by piping the newly created file in

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

phinjensen commented Nov 11, 2017

bish0polis commented Sep 30, 2018

aghsmith commented Dec 18, 2019

phinjensen commented Nov 11, 2017 •

edited by sethjensen1

Loading