So I have been able to create a Certificate Signing Request with a Subject Alternative Name of the form subjectAltName=IP: by following the recipe in a previous (splendid) answer.

When I inspect that CSR with openssl req -in key.csr -text I can see a corresponding section:

Requested Extensions:
  X509v3 Subject Alternative Name: 
    IP Address:

I then proceed to signing the CSR with a self-signed key like so:

openssl x509 -req -days 365 -CA ca.crt -CAkey ca.key -CAcreateserial \
  -in key.csr -out key.crt

The resulting certificate (when inspected with openssl x509 -in key.crt -text) does not identify that section any more.

Is this just an artifact of display parameters or need I also instruct openssl x509 that it should include the extension when doing its signing (and if so, how)?

I am using OpenSSL on macOS High Sierra (openssl version reports LibreSSL 2.2.7) and have not changed its configuration from the defaults. The keys will ultimately be used between Debian (Stretch) servers, so I could perform key generation there, if it helps in this context.


The following command apparently resolves the issue:

openssl x509 -req -days 365 -CA ca.crt -CAkey ca.key -CAcreateserial \
  -extensions SAN \
  -extfile <(cat /etc/ssl/openssl.cnf \
    <(printf "\n[SAN]\nsubjectAltName=IP:")) \
  -in key.csr -out key.crt

It is the same recipe as for openssl req, but with the two parameters extensions and extfile instead of reqexts and config.

This command was helpful for quickly confirming the desired outcome by printing the relevant section:

openssl x509 -in key.crt -text | grep "Subject Alternative Name" -C 1
  • Well done! Thanks also for sharing your solution. -- Finally: It's well and proper to click the checkmark/accept button on your own answer. (I suggest you do that so that so that the question will then no longer be listed in the "unanswered" section.) – StackzOfZtuff Aug 3 '18 at 11:27
  • @StackzOfZtuff Thx but there is apparently a mandatory rule: "You can accept your own answer in 2 days." – Drux Aug 3 '18 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.