Additional SANs in CSR are ignored

[rufoa]

When I use the LE client to request a certificate for more than one hostname, only the first one seems to be included in the certificate. All additional hostnames seem to be ignored. However, the CSR which is generated appears to be correct - the problem seems to be occurring at the boulder end.

e.g. I request a cert for "example.org,www.example.org"
The CSR has CN=example.org, SAN={example.org,www.example.org}

Expected cert:
CN=example.org, SAN={example.org,www.example.org}

Actual issued cert:
CN=example.org, SAN={example.org}

I can't see any obvious error in certificate-authority.go - is this a bug upstream in CFSSL perhaps?

[jdkasten]

Unless you are using the boulder branch of the LE client... the client
isn't communicating with Boulder.

The master branch is still using v00 of the protocol and working with the
node-acme server that doesn't support multiple hostnames.

I am currently cleaning up the boulder branch, adding account
infrastructure to go with the registration, and writing test cases.
Hopefully I can get a pull-request to master by tomorrow.

I did test the boulder branch with multiple hostnames though and it appears
to work.

Sorry about the confusion.
James

On Wed, Apr 15, 2015 at 7:45 PM, rufoa notifications@github.com wrote:

When I use the LE client to request a certificate for more than one
hostname, only the first one seems to be included in the certificate. All
additional hostnames seem to be ignored. However, the CSR which is
generated appears to be correct - the problem seems to be occurring at the
boulder end.

e.g. I request a cert for "example.org,www.example.org"
The CSR has CN=example.org, SAN={example.org,www.example.org}

Expected cert:
CN=example.org, SAN={example.org,www.example.org}

Actual issued cert:
CN=example.org, SAN={example.org}

I can't see any obvious error in certificate-authority.go - is this a bug
upstream in CFSSL perhaps?

—
Reply to this email directly or view it on GitHub
#98.

[rufoa]

Ah that explains it! Thanks and sorry for the misunderstanding.