Linked Questions

2
votes
0answers
66 views

CSR Generation for Root and Subdomain FQDNs [duplicate]

I need to secure services operating under my root domain (e.g. example.com) and one or more services operating under subdomains of that root domain (e.g. api.example.com, mail.example.com, etc). I can ...
13
votes
4answers
32k views

Missing X509 extensions with an openssl-generated certificate

My goal is to create a certificate with opensslsimilar to this one generated with cfssl Certificate: Data: Version: 3 (0x2) Serial Number: 60:44:dc:0d:80:f4:54:55:e8:...
6
votes
2answers
11k views

Subject Alternative Name in Certificate Signing Request apparently does not survive signing

So I have been able to create a Certificate Signing Request with a Subject Alternative Name of the form subjectAltName=IP:1.2.3.4 by following the recipe in a previous (splendid) answer. When I ...
6
votes
2answers
4k views

My S/MIME certificate (created with OpenSSL) does not match my email address

I created a certificate with OpenSSL and following commands: openssl req -x509 -nodes -days 365 -subj '/C=DE/ST=state/L=city/CN=hostname' -newkey rsa:1024 -keyout mycert.pem -out mycert.pem ...
2
votes
1answer
981 views

How to copy Subject Alternative Names in csr while signing a cert?

I already know how to add Subject Alternative Names (SANs) to a Certificate Signing Request and I know it's possible to manually add once again to a certificate which is similar to add SAN to csr ...
1
vote
0answers
1k views

Followup to one-liner to create cert request with SAN

I've been trying to use the OpenSSL line from this older thread to create a CSR with subject alternative name: Provide subjectAltName to openssl directly on command line If I run the line from that ...
0
votes
0answers
1k views

Specify Subject Alt Names in OpenSSL CA

I know you can use -addext with openssl req..... but, are you able to do that with openssl ca....? I would like to be able to add Subject Alternative Names with only one command without having to edit ...
0
votes
1answer
454 views

Generate X509 ERR_CERT_COMMON_NAME_INVALID

I am trying to set up https server on python3, but I could not generate a certificate and a key properly. That is the server code: import http.server, ssl server_address = ('localhost', 4443) httpd =...
0
votes
1answer
325 views

Error Loading extension 'copy_extensions' in Openssl

While running the following command on Ubuntu 19.10, with OpenSSl 1.1.1c 28 May 2019: openssl req -config ${CNF_FILE} -key ${PRIVATE_FILE} -new -x509 -days 10950 -sha384 -extensions v3_ca -out ${...
0
votes
2answers
216 views

Where to put SAN

Where SAN means: Subject Alternative Name. I feel I have a basic misunderstanding in which certificate the SAN stuff shall go: ca or server or both or what? It might be 3 Years or more in the past, ...
0
votes
0answers
48 views

SAN is getting replaced into CSR with CA's SAN

I am using the following command to create a certificate sign request file. openssl.exe req -new -key clinetkey.pem -out client.csr" -config client_cacert.cnf where client_cacert.cnf has the ...