What is subjectAltName ?
subjectAltName specifies additional subject identities, but for host names (and everything else defined for subjectAltName) :
subjectAltName must always be used (RFC 2818 22.214.171.124, 1. paragraph). CN is only evaluated if subjectAltName is not present and only for compatibility with old, non-compliant software. So if you set subjectAltName, you have to use it for all host names, email addresses, etc., not just the "additional" ones.
subjectAltName and CAcert CSR parser
The CSR parser strips any commonNames and subjectAltNames if the system can't match the domain in the system to your account, you can view domains listed on your account by going to the domains section of the website after you log in, and then clicking on View
According to the standards commonName will be ignored if you supply a subjectAltName in the certificates, verified to be working in both the latest version of MS IE and Firefox (as of 2005/05/12)...
Add multiple SANs into your CSR with OpenSSL
- Copy your default openssl.cnf file to a temporary openssl-san.cnf file
- Edit the openssl-san.cnf file to add addtl. required parameters
[req] req_extensions = v3_req [ v3_req ] # Extensions to add to a certificate request basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [alt_names] DNS.1 = server1.yourdomain.tld DNS.2 = mail.yourdomain.tld DNS.3 = www.yourdomain.tld DNS.4 = www.sub.yourdomain.tld DNS.5 = mx.yourdomain.tld DNS.6 = support.yourdomain.tld
Create the OpenSSL Private Key and CSR with OpenSSL
- 2 openssl commands in series
openssl genrsa -out srvr1-yourdomain-tld-2048.key 2048 openssl req -new -out srvr1-yourdomain-tld-2048.csr -key srvr1-yourdomain-tld-2048.key -config openssl-san.cfg
Check multiple SANs in your CSR with OpenSSL
- the openssl command
openssl req -text -noout -in <yourcsrfile>.csr
- will result in
eg. Certificate Request: Data: Version: 0 (0x0) Subject: C=DE, ST=Germany, L=City, O=Company, OU=Organisation-Unit, CN=server1.yourdomain.tld/emailAddressfirstname.lastname@example.org Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): [...] Exponent: 65537 (0x10001) Attributes: Requested Extensions: X509v3 Basic Constraints: CA:FALSE X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment X509v3 Subject Alternative Name: DNS:server1.yourdomain.tld, DNS:mail.yourdomain.tld, DNS:www.yourdomain.tld , DNS:www.sub.yourdomain.tld, DNS:mx.yourdomain.tld, DNS:support.yourdomain.tld Signature Algorithm: sha1WithRSAEncryption [...]
Copy content of CSR file to New Server Cert Form ...
- ... and process the signing request results in an output:
Please make sure the following details are correct before proceeding any further. CommonName: server1.yourdomain.tld subjectAltName: DNS:server1.yourdomain.tld subjectAltName: DNS:mail.yourdomain.tld subjectAltName: DNS:www.yourdomain.tld subjectAltName: DNS:www.sub.yourdomain.tld subjectAltName: DNS:mx.yourdomain.tld subjectAltName: DNS:support.yourdomain.tld No additional information will be included on certificates because it can not be automatically checked by the system. [submit]
- results in
Below is your Server Certificate -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE-----
copy & paste the text including
"-----BEGIN CERTIFICATE-----" -and- "-----END CERTIFICATE-----"
- into a new file, e.g. srvr1-yourdomain-tld-2048-signed-class1.key
Verify the Signed (Public) Keyfile with OpenSSL
- the openssl command
openssl x509 -text -in srvr1-yourdomain-tld-2048-signed-class1.key -noout
- will result in
Certificate: Data: Version: 3 (0x2) Serial Number: 4451 (0x1163) Signature Algorithm: sha1WithRSAEncryption Issuer: C=AU, ST=New South Wales, O=CAcert Testserver, OU=http://cacert1.it-sls.de, CN=CAcert Testserver Root Validity Not Before: Sep 21 14:41:43 2012 GMT Not After : Oct 21 14:41:43 2012 GMT Subject: CN=server1.yourdomain.tld Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): [...] Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: critical CA:FALSE X509v3 Key Usage: critical Digital Signature, Key Encipherment, Key Agreement X509v3 Extended Key Usage: TLS Web Client Authentication, TLS Web Server Authentication, Ne tscape Server Gated Crypto, Microsoft Server Gated Crypto Authority Information Access: OCSP - URI:http://ocsp.cacert.org/ X509v3 CRL Distribution Points: URI:http://crl.cacert.org/revoke.crl X509v3 Subject Alternative Name: DNS:server1.yourdomain.tld, othername:<unsupported>, DNS:mail.yourdomain.tld, othername:<unsupported>, DNS:www.yourdomain.tld, othername:<unsupported>, DNS :www.sub.yourdomain.tld, othername:<unsupported>, DNS:mx.yourdomain.tld, othername:<un supported>, DNS:support.yourdomain.tld, othername:<unsupported> Signature Algorithm: sha1WithRSAEncryption [...]