I already know how to add Subject Alternative Names (SANs) to a Certificate Signing Request and I know it's possible to manually add once again to a certificate which is similar to add SAN to csr using OpenSSL like this:

openssl x509 -req -extfile < (printf "subjectAltName=IP:xxx" -days xxx -in xxx.csr -signkey xxx.key -out xxx.crt

Is there a way to achieve this with CLI?

The key is copy_extensions. I'll try it. And this link explains it: https://unix.stackexchange.com/a/372393

  • 1
    Hello and welcome to Stack Exchange. Your question is about the use of a command line tool, not about information security. I therefore voted to migrate this question to Super User, as you have better chances of getting an answer there.
    – user163495
    Sep 11, 2019 at 9:18
  • Do you mean creating a CSR, or the 'signing' (really issuing) operation that reads a CSR? For the former, dupe security.stackexchange.com/questions/74345/… . Also to be clear, you can use a config file other than openssl.cnf, so you can modify the config file without modifying openssl.cnf; does that meet your requirement? Sep 12, 2019 at 4:37
  • @dave_thompson_085, thanks for your reply. I have already read that link. I think my question like this. mta.openssl.org/pipermail/openssl-users/2016-January/….
    – Peter
    Sep 12, 2019 at 14:07
  • The Subject of this question, then, doesn't match your actual question (based on that openssl-users link) - you want to sign the CSR purely CLI, not generate the CSR purely CLI.
    – gowenfawr
    Sep 12, 2019 at 14:30
  • That email is vague but is either about specifying SAN in the operation that issues the cert from the CSR (such as the x509 -req -signkey you posted) or copying SAN from CSR to cert, which is a different operation and covered by different Qs: see security.stackexchange.com/questions/150078/… and maybe cross unix.stackexchange.com/questions/371997/… . Sep 13, 2019 at 1:59

1 Answer 1


It is not possible to specify a SAN in OpenSSL solely at the command line*.

FWIW, I wrote a wrapper that allows you to do that by dynamically generating a temporary openssl.cnf behind the scenes for you: one_genkey

A script for creating Certificate Signing Requests from the CLI, hiding the OpenSSL config file complexity.

*Per dave_thompson_085's pointer to this answer, openssl 1.1.1 added an -addext option to req which will allow this. The sheer ingenuity of contortions provided in all the other answers on that page are a testament to how big a pain this has been for all time leading up to openssl 1.1.1, and all those systems (cough RHEL) still languishing with something other than the head branch.

  • 1
    For CSR (NOT cert) 1.1.1 (2018-09) has req -addext; see the link in my comment on the Q. Sep 12, 2019 at 4:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.