Merge -addext option from upstream

[Ypnose]

OpenSSL binary OpenSSL 1.1.1 11 Sep 2018 now supports -addext ext option, useful to provide a specific extension, like SAN.
https://www.openssl.org/docs/man1.1.1/man1/req.html

OpenSSL binary from LibreSSL LibreSSL 2.9.2 doesn't support it, so it is kinda inconvenient to generate CSR, where LibreSSL is used (OpenBSD, Linux distributions migrated to LibreSSL).

Here the command I used to test :

openssl req -sha256 -new -newkey rsa:4096 -nodes -addext "subjectAltName = DNS:foo.co.uk" -keyout pkey.pem -out csr.pem

Here the related discussion :
openssl/openssl#3311

Could it possible to merge upstream change to LibreSSL ?

[Ypnose]

Hi,
Any update on this ?

[otto-dev]

Can't use libressl without this because of subjectAltNames

[kinichiro]

Here is temporary workaround to put subjectAltName without -addext option.

#!/usr/local/bin/bash

openssl req -newkey rsa:2048 -days 365 -nodes -x509 \
    -subj "/C=/ST=/L=/O=/OU=/CN=*.foo.co.uk" \
    -extensions SAN \
    -config <(cat /etc/ssl/openssl.cnf \
            <(printf "[SAN]\nsubjectAltName='DNS:foo.co.uk'")) \
    -keyout pkey.pem -out csr.pem

[kinichiro]

-addext option was added in upstreram libressl/openbsd@6d41544

[ip75]

Here is temporary workaround to put subjectAltName without -addext option.

#!/usr/local/bin/bash

openssl req -newkey rsa:2048 -days 365 -nodes -x509 \
    -subj "/C=/ST=/L=/O=/OU=/CN=*.foo.co.uk" \
    -extensions SAN \
    -config <(cat /etc/ssl/openssl.cnf \
            <(printf "[SAN]\nsubjectAltName='DNS:foo.co.uk'")) \
    -keyout pkey.pem -out csr.pem

-extensions is not work with req command. libressl-3.0.2
I can not set subjectAltNames to certificate

[4a6f656c]

@ip75 works for me...

$ openssl version
LibreSSL 3.0.2
$openssl req -newkey rsa:2048 -days 365 -nodes -x509 \
    -subj "/C=/ST=/L=/O=/OU=/CN=*.foo.co.uk" \
    -extensions SAN \
    -config <(cat /etc/ssl/openssl.cnf \
            <(printf "[SAN]\nsubjectAltName='DNS:foo.co.uk'")) \
    -keyout pkey.pem -out csr.pem
$ openssl x509 -text -in csr.pem | grep DNS: -B2
        X509v3 extensions:
            X509v3 Subject Alternative Name: 
                DNS:foo.co.uk

[4a6f656c]

Closing since this will be available in the next release.