How to add AltName from csr file to crt file using "openssl x509 -req"?

Question

I'm a webdeveloper and want to test my websites locally with a self signed SSL certificate. Everything was working great until a few days ago, when chrome started complaining about a missing AltName property.

OpenSSL CA

I've created my own authority using:

openssl req
    -x509
    -sha256
    -new
    -out dev.root.ca.crt
    -keyout dev.root.ca.key
    -days 3650

CNF

I've created an openssl.cnf file by adding those values to the default ones:

[ CA_default ]
copy_extensions = copy

[req]
req_extensions = v3_req

[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = $ENV::ALTNAME

ALTNAME via shell

Then I use this command to generate a .csr and .key file:

set ALTNAME=DNS:dev.example.com

openssl req
    -newkey rsa:2048
    -out dev.example.com.csr
    -pubkey
    -new
    -keyout dev.example.com.key
    -sha256
    -config openssl.cnf

The generated csr file contains the alternative name as expected.

Altname does not make it from CSR into CRT

Then I use this command to generate the .crt and .key files:

openssl x509
    -req
    -in dev.example.com.csr
    -CA dev.root.ca.crt
    -CAkey dev.root.ca.key
    -CAcreateserial
    -out dev.example.com.crt
    -days 3650
    -sha256

But the alternative names are not present anymore in the generated crt file.

What now?

Do I need to add additional parameters to the openssl x509 -req command ?

Answer 1

Using the '-extfile' parameter fixed it.

Additional config file

I have added an openssl-ext.cnf file containing:

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = $ENV::ALTNAME

Using '-extfile' parameter

And added that new config file to the openssl command using the -extfile parameter:

openssl x509
    -req
    -in dev.example.com.csr
    -CA dev.root.ca.crt
    -CAkey dev.root.ca.key
    -CAcreateserial
    -out dev.example.com.crt
    -days 3650
    -sha256
    -extfile openssl-ext.cnf