Subject Alternative Name is not copied to signed certificate

ssl openssl self-signed ca
4ybaka picture 4ybaka · Nov 30, 2015 · Viewed 7.1k times · Source

I use self-signed CA cert to sign other certificates. For some certs I need to specify subject alternative names. I can specify them during request generation (openssl req ...) and I see them in .csr file. Then I sign it with CA cert using 

openssl x509 -req -extensions x509v3_config -days 365 -in ${name}.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out ${name}.crt

and next sections in openssl.cnf file:

[ x509 ]
x509_extensions = x509v3_config

[ x509v3_config ]
copy_extensions = copy

but I see no SAN in .crt file.

I know about solutions with openssl ca ... command but I have no valid [ca] section and I don't want to copy/paste it without deep understanding what it does. So I hope that exists another solution with openssl x509 ... command.

Answer

frasertweedale picture frasertweedale · Nov 30, 2015

The copy_extensions directive is only understood by the openssl ca command. There is no way to copy extensions from a CSR to the certificate with the openssl x509 command.

Instead, you should specify the exact extensions you want as part of the openssl x509 command, using the same directives you used for openssl req.

Related questions

Client SSL with Self Signed CA not working

I have been struggling with an SSL problem for more than 1 month. We have used openssl to generate our own CA, server and client certificates. We have also enable "SSLrequire" on the Apache web server (in htaccess this may be …

Read More
import self signed certificate in redhat

How can I import a self-signed certificate in Red-Hat Linux. I'm not an expert with respect to certificates and find it difficult to find the right answer through googling, since I don't know the difference between a .cer, .crt or …

Read More
Invalid CA certificate with self signed certificate chain

I have a self signed certificate chain with these commands and configured them on an Apache server But when i try openssl s_client -showcerts -servername server -connect my-host.local:443 -CAfile all.crt I get an error from openssl Verify …

Read More