1. 技术文章
  2. OpenSSL Version V3 with Subject Alternative Name

OpenSSL Version V3 with Subject Alternative Name

由 烂漫一生 提交于 2019-12-02 18:14:10

Here is the simple steps for you

While generating the CSR you should use -config and -extensions and while generating certificate you should use -extfile and -extensions

Here is the example 

openssl req -new -nodes -keyout test.key  -out test.csr -days 3650 -subj "/C=US/ST=SCA/L=SCA/O=Oracle/OU=Java/CN=test cert" -config /etc/pki/tls/openssl.cnf -extensions v3_req
openssl x509 -req -days 3650 -in test.csr -CA cacert.pem -CAkey rootCA.key -CAcreateserial -out test.pem -extfile /etc/pki/tls/openssl.cnf  -extensions v3_req

hope this helps

I got it to work with the following version (emailAddress was incorrectly placed) :

[ req ]
default_bits        = 2048 
default_keyfile     = privkey.pem 
distinguished_name  = req_distinguished_name
req_extensions          = v3_req
x509_extensions         = v3_ca

[req_distinguished_name]
C = [Press Enter to Continue]
C_default = US 
C_min = 2 
C_max = 2 

O = [Press Enter to Continue]
O_default = default 

0.OU=[Press Enter to Continue]
0.OU_default = default 
1.OU=[Press Enter to Continue]
1.OU_default = PKI 
2.OU=[Press Enter to Continue] 
2.OU_default = ABCD
commonName = Public FQDN of server 
commonName_max = 64
emailAddress = [Press Enter to Continue] 
emailAddress_default = myEmail@email.com

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment

[ v3_ca ]
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid:always,issuer:always
subjectAltName         = email:myEmail@email.com
issuerAltName          = issuer:copy

Notes:

  • To generate the certificate I used:

    openssl req -config req.cnf -new -nodes -out req.pem -x509
  • I haven't seen much use for issuerAltname (if you have I'd be interested to know where).
  • Using issuer:always isn't recommended for authorityKeyIdentifier.
  • Using email:copy now works with subjectAltName.
  • v3_req section is superfluous (as well as req_extensions line.

Alright, none of the other answers on this page worked for me, and I tried every last one of them. What worked for me was a little trick:

when requesting the cert:

-config '<(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:$SERVER"))' 
-reqexts SAN

and when signing the cert:

-extfile '<(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:$SERVER"))' 
-extensions SAN

So there is no confusion, here is a working script that covers everything from the start, including creating a certificate authority:

# if the server name is undefined, lets default to 'Some-Server'
SERVER="${SERVER:-Some-Server}"

CORPORATION=My-Corp
GROUP=My-Corporate-Group
CITY=City
STATE=State
COUNTRY=US

CERT_AUTH_PASS=`openssl rand -base64 32`
echo $CERT_AUTH_PASS > cert_auth_password
CERT_AUTH_PASS=`cat cert_auth_password`

# create the certificate authority
openssl \
  req \
  -subj "/CN=$SERVER.ca/OU=$GROUP/O=$CORPORATION/L=$CITY/ST=$STATE/C=$COUNTRY" \
  -new \
  -x509 \
  -passout pass:$CERT_AUTH_PASS \
  -keyout ca-cert.key \
  -out ca-cert.crt \
  -days 36500

# create client private key (used to decrypt the cert we get from the CA)
openssl genrsa -out $SERVER.key

# create the CSR(Certitificate Signing Request)
openssl \
  req \
  -new \
  -nodes \
  -subj "/CN=$SERVER/OU=$GROUP/O=$CORPORATION/L=$CITY/ST=$STATE/C=$COUNTRY" \
  -sha256 \
  -extensions v3_req \
  -reqexts SAN \
  -key $SERVER.key \
  -out $SERVER.csr \
  -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:$SERVER")) \
  -days 36500

# sign the certificate with the certificate authority
openssl \
  x509 \
  -req \
  -days 36500 \
  -in $SERVER.csr \
  -CA ca-cert.crt \
  -CAkey ca-cert.key \
  -CAcreateserial \
  -out $SERVER.crt \
  -extfile <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:$SERVER")) \
  -extensions SAN \
  -passin pass:$CERT_AUTH_PASS

We can then verify that the Subject Alternative name is in the final cert:

openssl x509 -in Some-Server.crt -text -noout

The pertinent section is:

    X509v3 extensions:
        X509v3 Subject Alternative Name: 
            DNS:Some-Server

So it worked! This is a cert that will be accepted by every major browser (including chrome), so long as you install the certificate authority in the browser. Thats ca-cert.crt that you will need to install.

Here is a sample configuration for ngnx that would allow you to use the cert:

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name  localhost:443;

    ssl_certificate /etc/ssl/certs/Some-Server.crt;
    ssl_certificate_key /etc/ssl/private/Some-Server.key;
    ssl_dhparam /etc/ssl/certs/https-dhparam.pem;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }
}

What command did you use to make the CSR certificate request? What command did you use to make the certificate file? Different answers for different circumstances you know.

Maybe you are not putting

subjectAltName=email:copy

in the section

[v3_req]

Maybe you are using openssl x509 to generate the certificate, if so you must use

-extfile /etc/pki/tls/openssl.cnf

because without that it doesnt use your config file

You also might need

-extensions v3_req

command line switch

I just developed a web based tool that will generate this command automatically based on form input and display the output. http://kernelmanic.com/certificate-request-generator-with-multiple-common-names-and-subject-alternative-names/

Dominic

The v3_req is required with the entry subjectAltName in the config file. The command 

openssl x509 ... -extfile openssl.cnf -extensions v3_req

will insert the SAN into the certificate.

I know this thread is a little old but just in case it works for anyone on windows, check that the file is UTF-8 encoded, in my case I was getting an error indicating there was an error with the .cnf file, so I opened it on Notepad++ set the file encoding to UTF-8, saved, and ran the openssl command again and it made the trick.

I referred to several pages, and the most significant helps are from 1. https://geekflare.com/san-ssl-certificate/, 2. https://certificatetools.com/ (see answer from user40662), and 3. answer from Raghu K Nair about the command usage.

Then my successful try:

san.cnf

[ req ]
default_bits       = 2048
default_md         = sha256
distinguished_name = req_distinguished_name
req_extensions     = v3_req
[ req_distinguished_name ]
countryName            = CN                     # C=
stateOrProvinceName    = Shanghai               # ST=
localityName           = Shanghai               # L=
#postalCode             = 200000                 # L/postalcode=
#streetAddress          = "My Address"           # L/street=
organizationName       = My Corporation         # O=
organizationalUnitName = My Department          # OU=
commonName             = myname.mysoftware.mycorporation.com # CN=
emailAddress           = myname@example.com     # CN/emailAddress=
[ v3_req ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1   = myname.mysoftware.mycorporation.com
#DNS.2   = other2.com
#DNS.3   = other3.com

Command:

openssl req -x509 -nodes -days 365 -subj "/C=CN/ST=Shanghai/L=Shanghai/O=My Corporation/OU=My Department/CN=myname.mysoftware.mycorporation.com/emailAddress=myname@example.com" -keyout privateKey.pem -out certificate.crt -config san.cnf -extensions v3_req
标签
certificate
OpenSSL
x509
pki
易学教程内所有资源均来自网络或用户发布的内容，如有违反法律规定的内容欢迎反馈！
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!