How to create CSR with SANs using keytool

certificate keytool

Betlista · Jun 10, 2015 · Viewed 44.1k times · Source

I'd like to ask whether it is possible to create CSR that contains SAN records.

I created keystore as

keytool -genkeypair -keyalg RSA -keysize 2048 -alias testAlias -ext SAN=dns:test.example.com -keystore test.jks -storetype JKS -dname "CN=test"

I can check using keytool, that SAN is in keystore

keytool -list -v -keystore test.jks

and relevnt part of the output is

#1: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: test.example.com
]

Then I created CSR using keytool:

keytool -certreq -file test.csr -keystore test.jks -alias testAlias

but in CSR there is information about SAN missing.

How to check:

keytool -printcertreq -file test.csr -v

correctly there should be something similar to

Extension Request:

#1: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: test.example.com
]

Did I miss some option for certreq ?

Answer

when You generate CSR you need to specify -ext attribute again

keytool -certreq -file test.csr -keystore test.jks -alias testAlias -ext SAN=dns:test.example.com