I know you can use -addext with openssl req..... but, are you able to do that with openssl ca....? I would like to be able to add Subject Alternative Names with only one command without having to edit the configuration file.

  • 2
    What's the point in adding alternative names in CA certificates?
    – Crypt32
    Feb 21, 2019 at 20:47
  • I'm using a CA to sign server/domain certificates, in most modern browsers if you don't have a Subject Alternative Name then it'll reject the certificate as invalid.
    – Matthew
    Feb 21, 2019 at 23:26
  • Dupe security.stackexchange.com/questions/74345/… : you can (set and) use an env var, or on Unix with some shells you can use process substitution <( ... ) to create a temporary file Feb 22, 2019 at 3:12
  • @Matthew I believe you misunderstand the SAN requirement. It is required only in end entity SSL certificates. CA certificates do not fall under this requirement.
    – Crypt32
    Feb 22, 2019 at 5:29
  • I'm using openssl ca to sign domain certificates, as listed above. I'm not adding the Subject Alternative Names to the CA, but rather the end-entity certificates I am signing, as stated above. I want to know if I can add SANs in the command.
    – Matthew
    Feb 24, 2019 at 2:30


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.