Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

creating a cert doesn't include altnames #13

Closed
jamesrgrinter opened this issue Jul 9, 2013 · 1 comment
Closed

creating a cert doesn't include altnames #13

jamesrgrinter opened this issue Jul 9, 2013 · 1 comment

Comments

@jamesrgrinter
Copy link

I'm creating a self-signed cert with openssl::certificate::x509, like so:

 ssl_prefix => 'ukprd'
 servicename => "uk.example.com",
 altnames   => ['uk.example.com','server.example.co.uk'],

then using:

 openssl::certificate::x509 { "${ssl_prefix}":
    ensure       => present,
    country      => 'GB',
    organization => 'My Company Ltd',
    commonname   => "$servicename",
    state        => 'London',
    locality     => 'London',
    unit         => 'Engineering',
    altnames     => $altnames,
    email        => 'engineering@example.com',
    days         => 3650,
    base_dir     => "/www/${name}/ssl",
    owner        => 'root',
    password     => "$ssl_pass",
    force        => false,
 }

and in the resulting CSR, I see everything as it should be:

$ openssl req -text -noout -in ./server.example.com/ssl/ukprd.csr
Certificate Request:
  Data:
    Version: 0 (0x0)
    Subject: C=GB, ST=London, L=London, O=My Company Ltd, OU=Engineering, CN=uk.example.com/emailAddress=engineering@example.com
...
    Attributes:
    Requested Extensions:
        X509v3 Subject Alternative Name: 
            DNS:uk.example.com, DNS:server.example.co.uk
...

(as per the generated ukprd.cnf OpenSSL configuration file)

but the created certificate doesn't include those alternative names:

$ openssl x509 -text -in ./server.example.com/ssl/ukprd.crt -noout

Certificate:
   Data:
       Version: 1 (0x0)
       Serial Number:
           99:57:4b:c4:5c:7c:99:e6
       Signature Algorithm: sha1WithRSAEncryption
       Issuer: C=GB, ST=London, L=London, O=My Company Ltd, OU=Engineering, CN=uk.example.com/emailAddress=engineering@example.com
...
       Subject: C=GB, ST=London, L=London, O=My Company Ltd, OU=Engineering, CN=uk.example.com/emailAddress=engineering@example.com
...
@mcanevet
Copy link
Member

mcanevet commented Mar 3, 2014

@jamesrgrinter Could you please test with the latest version available on the forge. I close this old PR for the time being, feel free to reopen if you think it is still relevant.

@mcanevet mcanevet closed this as completed Mar 3, 2014
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants