Questions tagged [san]

SubjectAltName is an extension field in an X.509 certificate that allows the inclusion of alternate names for the certificate holder, such as domain names, email addresses, etc.

Filter by
Sorted by
Tagged with
0 votes
1 answer
32 views

Connection problems with common name as domain

I was exploring SAN certs and was able to connect to the machine with domains specified in the SAN fields during CSR creation. But I was unable to connect to the machine with the common name specified ...
0 votes
1 answer
56 views

Multi Domain SAN or single SSL certificate

I want to use a multi-domain SAN certificate for 5 of my public-facing domains. All of these domains point to the same ingress server (SSL is terminated at the load balancer), but the backend ...
2 votes
1 answer
174 views

What is the security advantage of requiring the CN to be in the SAN list?

For quite a while, it has been common that the CN of a web server certificate also needs to be present in the SAN list, and new versions of browsers enforce this. So, if my CN is www.example.com, and ...
2 votes
1 answer
250 views

Ramifications of including "localhost" in the subject alternative field of a x509 certificate?

Are we inviting any problems if we add localhost and 127.0.0.1 to the subject alternative name field of an x509 certificate? We are still trusting the appropriate root CA, but relaxing the rules of ...
0 votes
1 answer
89 views

SSL Cert SAN field

I'm not really sure exactly how to ask this, but I'll try my best. I have two SSL certs, and I'm tyring to figure out if I accidentally invalidated one of them. Cert 1 was just renewed, and issued to ...
  • 111
0 votes
1 answer
924 views

OpenSSL GENERAL_NAME:bad ip address set in [alt_names]

I am getting this error in my device: javax.net.ssl.SSLException: hostname in certificate didn't match: <ec2-5-43-58-857.us-east-2.compute.amazonaws.com> != <na> So I did some research ...
0 votes
1 answer
95 views

CA cert with many Subject Alternative Name (SAN) entries, versus individual certs in public production?

I'm looking into creating a CA certificate strategy where i work. And i was wondering if anyone had any points of interest to raise around the difference of a model where our .com and key subdomains ...
  • 441
0 votes
0 answers
138 views

SAN is getting replaced into CSR with CA's SAN

I am using the following command to create a certificate sign request file. openssl.exe req -new -key clinetkey.pem -out client.csr" -config client_cacert.cnf where client_cacert.cnf has the ...
0 votes
1 answer
3k views

Error Loading extension 'copy_extensions' in Openssl

While running the following command on Ubuntu 19.10, with OpenSSl 1.1.1c 28 May 2019: openssl req -config ${CNF_FILE} -key ${PRIVATE_FILE} -new -x509 -days 10950 -sha384 -extensions v3_ca -out ${...
  • 33
1 vote
1 answer
412 views

getting no subject alternative name present exception when the csr shows that the SANs are present [duplicate]

I am trying to setup ssl for grpc but no matter what I try I get a no subject alternative name present. I've verified the SANs are in the certificate signing request. The common name and also a SAN ...
  • 131
2 votes
1 answer
71 views

Is there a risk associated with to many entries in your SAN list? [duplicate]

Is there any risk associated with having lots of websites in your SAN list? For instance: Or is this common among website hosts, and possibly safe?
1 vote
2 answers
554 views

Are SAN IP addresses / DNS names useless in self signed certificates by untrusted CAs?

I want to generate a self signed certificate for temporary local testing of a web service via HTTPS. I don't want to install the CA though, because the self signed certificate is generated on the fly ...
  • 11
-1 votes
1 answer
458 views

SSL Certificate Subject Alternative Name Information Disclosure

I'd appreciate if someone could shed some lights on the subject findings. Is this a security problem having bank.com appearing on the SAN? Hostname was discovered in the Subject Alternative Name (...
  • 1
8 votes
2 answers
38k views

Add a San(Subject Alternative Name) to already existing cert?

So we have a system that generates a key for every server signed by the company CA. I need to add a SAN to it but don't really have access to the CSR. Is there anyway to add a SAN? Maybe generate ...
  • 203
0 votes
2 answers
335 views

How do cert authorities set and determine subjectAltNames if not provided by end user?

Let's say as an end user I generate a CSR (for a server cert) to send over to a CA and I don't include a subject alternative name. How or what would they do in order to include that information on the ...
  • 1
0 votes
1 answer
176 views

Certificate SAN Disclosure. How harmful can it be?

My daily job duties brought me (by mistake) to the following IP: 52.63.96.32 It appears the registrar has signed with a single certificate a "lot" of domain. https://www.shodan.io/host/52.63.96.32 ...
6 votes
1 answer
19k views

Chrome requires SAN names in Certificate. When will other browsers (IE) follow? [closed]

Chrome requires SSL Certificates to list the site name(s) in the subject alternative name (SAN) to be trusted. Usage of common name only is not seen as secure enough, and will result in a certificate ...
  • 528
0 votes
1 answer
612 views

DNS hijacking and Subject Alternative Names

My website is published on Google's Firebase Hosting. I own the domain. Google provision an SSL certificate (lately from Lets Encrypt, it used to be someone else). The certificate is shared between ...
14 votes
1 answer
18k views

Are certificate sans case sensitive

Creating a certificate request for my exchange server I am wondering if sans and CNs are case sensitive?
3 votes
1 answer
3k views

Same SAN listed in different certificates, both valid at the same time? [duplicate]

I am implementing a multi-master highly available service, which is deployed on two different machines. There is also third machine. It doesn't do anything other than cross-monitoring the cluster and ...
2 votes
1 answer
4k views

What are OIDs in the context of this keytool command?

I'm in the process of setting up a 3rd party plugin to Elasticsearch called Search Guard which requires also Search Guard SSL. While setting up Search Guard SSL, you're required to set up several ...
  • 245
1 vote
1 answer
260 views

Subject Alt Name certs

Is it ok to specify subdomains in certificates that support SAN. For example base domain is example.com and I want a.example.com, b.example.com, and c.example.com to be included? What is the primary ...
4 votes
2 answers
1k views

Multiple, different sites on same server. Individual SSL certificates for each or SAN certificate?

On a server containing multiple unrelated sites what is the best solution, in general, for applying SSL security to each site? Individual certificates for each site or a SAN certificate?
  • 141
2 votes
1 answer
148 views

What is the risk of data being recovered from SAN storage after logical deletion?

The specific scenario involves Linux servers on VMware hosts with SAN storage. If files containing sensitive data are deleted by Linux, can they be recovered by a low level tool similar to what might ...