I need help creating SSL certificate with multiple subjectAltNames, signed with my own selfbrewed CA certificate.

What I need:

I'm on OSX 10.10.5

I have myCA.cer which I use to sign another SSL certificate which has next alternative names:

(not sure if IP can be an alternative name though…)

  DNS.1 = foo.bearden.local
  DNS.2 = www.bearden.local
  DNS.3 =

I need to import this certificate to my iphone which already has myCA.cer. That's how it's going to be verified in iphone's OS.

What I do:

I run this shell script:

cat > ./cust.cnf <<-EOF
  distinguished_name = req_distinguished_name
  x509_extensions = v3_req
  prompt = no
  CN = *.bearden.local/ CN=
  keyUsage = keyEncipherment, dataEncipherment
  extendedKeyUsage = serverAuth
  subjectAltName = @alt_names
  DNS.1 = foo.bearden.local
  DNS.2 = www.bearden.local
  DNS.3 =

openssl genrsa -out foo.key 2048 -config ./cust.cnf && \
openssl req -new -out foo.csr -key foo.key -config ./cust.cnf && \
openssl x509 -req -sha256 -in foo.csr -extfile ./cust.cnf -out foo.crt -CAkey myCA.key -CA myCA.cer -days 365 -CAcreateserial -CAserial serial


1 -- Wildcard in CN doesn't work (Google chrome still says it's untrusted, even though I've set complete trust options in keychain)

2 -- When I add the cert to keychain (myCA.cer is already there) it recognizes it as valid and trusted, but the cert itself (foo.crt) doesn't have Alternative DNS names which I mentioned in config.

Please help me to get my multiple Alt DNS names for this kind of certificate

thank you!

  • Note that CN is completely ignored if any subjectAltNames are present. – grawity Dec 9 '15 at 20:26
  • Thank you for a note! But the cert doesn't show that subjectAltNames are present... Like for example when I create selfsigned cert without signing with myCA, I can see all of them in certificate details in keychain… I'm wondering why? Can it be that signing with myCA somehow blocks the possibility to have subjectAltNames? (it may sound like nonsense, but I'm weak at this stuff) – Drew Dec 9 '15 at 20:31
  • Please add the config to openssl x509 -req too. The SAN information are probably not taken from the CSR. – Steffen Ullrich Dec 9 '15 at 20:43
  • @SteffenUllrich I've already tried this but got error:unknown option -config usage: x509 args..... – Drew Dec 9 '15 at 20:51
  • See documentation for x509 and look at the -extfile option. Please look also at the examples using this option. – Steffen Ullrich Dec 9 '15 at 20:54

These are the changes I should have done to make it work (Thanks to Steffen Ullrich):

openssl x509 -req -sha256 -in foo.csr -extfile ./cust.cnf -extensions v3_req -out foo.crt -CAkey myCA.key -CA myCA.cer -days 365 -CAcreateserial -CAserial serial

here is the openssl documentation explaining how the -extfile and -extensions options work

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.