0

I have been trying to generate a CSR which includes a san of type OtherName.

the generated CSR does not seem to have the SAN field.

this is the configuration file:

distinguished_name = req_distinguished_name
[req_distinguished_name]
countryName                 = Country Name (2 letter code)
stateOrProvinceName         = State or Province Name (full name)
localityName               = Locality Name (eg, city)
organizationName           = Organization Name (eg, company)
commonName                 = Common Name (e.g. server FQDN or YOUR name)
[v3_req_client]
extendedKeyUsage = clientAuth
subjectAltName = @alt_names
[alt_names]
otherName = 1.3.6.1.4.1.311.20.2.3;UTF8:user@localhost

I generate the CSR as this:

openssl req -out user.csr -newkey rsa:2048 -nodes -keyout private.key -config openssl.conf

but the resulting CSR does not have subjectaltNames field:

ertificate Request:
Data:
    Version: 1 (0x0)
    Subject: C = co, CN = user
    Subject Public Key Info:
        Public Key Algorithm: rsaEncryption
            RSA Public-Key: (2048 bit)
            Modulus:
                00:df:19:be:1d:55:7d:f9:3a:29:e8:11:f6:ce:50:
                76:61:6b:5b:36:10:a7:b0:ac:99:83:0f:0f:a4:c6:
                1d:d7:c2:33:96:16:7b:5e:52:65:25:9f:e7:00:79:
                7d:b6:92:73:bb:5a:37:6d:ee:1f:18:09:71:bb:46:
                7c:65:95:1b:03:83:cf:ef:a8:79:0c:d0:bd:99:a5:
                34:5d:97:c3:29:d3:b6:59:4b:90:8c:57:65:aa:7d:
                9a:c3:7d:22:50:36:b0:e7:ba:c5:59:b0:f8:f0:90:
                26:4e:09:5b:5c:75:f2:1d:db:f4:aa:47:c0:65:b1:
                79:b6:10:7e:df:88:1f:9b:25:e4:20:69:09:36:8f:
                0e:ca:7c:2f:35:e2:7a:1e:c1:87:0f:20:0c:de:9e:
                94:17:8d:d3:4a:73:53:6d:88:d1:8b:e6:00:ca:e2:
                0c:99:ff:0b:6b:cb:5a:2d:e0:d0:27:5c:c0:66:ae:
                ce:b0:11:4a:9a:2c:30:f7:e2:bc:b0:2e:ac:eb:69:
                dd:db:9d:b5:84:85:24:80:d8:64:b5:c0:bc:d5:de:
                16:b7:0f:82:9c:8a:5b:9a:c8:21:40:20:42:cd:0b:
                64:55:55:76:56:11:af:b5:0b:3d:dc:81:28:61:d2:
                ff:c9:fd:43:2b:e3:1e:2e:c8:66:7b:21:14:4d:8d:
                45:c7
            Exponent: 65537 (0x10001)
    Attributes:
        a0:00
Signature Algorithm: sha256WithRSAEncryption
     23:b2:58:69:c3:93:b9:f4:45:2e:45:fa:af:e8:69:09:8d:3f:
     65:cb:6e:aa:3a:95:04:6a:21:81:02:c2:2f:fc:f4:98:cf:71:
     5a:4f:36:8e:e7:f5:09:a2:d3:8f:3d:49:55:6b:93:ed:bb:7e:
     78:c2:43:26:c1:6d:bf:9d:3c:29:3a:29:67:90:04:5a:fd:4f:
     9c:9d:7f:bb:98:67:ce:ab:66:be:0e:d5:af:4a:e5:fb:3b:72:
     c4:9c:cd:d7:f4:1c:81:2e:32:c5:8a:c5:d7:d7:9f:bc:1d:c9:
     51:94:0e:30:70:92:e1:ac:d4:d7:93:d8:9a:b8:5e:83:fc:cb:
     ab:6c:d4:f1:7f:70:96:f6:61:b8:48:14:d9:dc:1e:02:d3:ae:
     e5:90:1c:46:67:f3:99:2e:6e:4b:52:8e:71:0d:d2:31:2e:e6:
     0b:f9:88:b2:b8:a9:63:7a:5b:60:08:a4:ce:b8:5e:08:a7:cb:
     58:29:28:e4:30:85:2e:63:ae:bf:2b:51:ec:cc:29:96:16:72:
     20:80:d7:df:63:05:e8:f4:eb:59:d9:98:a2:f5:81:9f:7f:48:
     28:96:3f:bd:0f:e4:93:1a:d1:8d:53:d2:12:67:aa:52:3b:fe:
     f0:cf:c0:e5:7f:e4:96:16:c7:44:3f:5e:60:7a:f9:87:a8:e0:
     53:af:35:cd

but if a generate a certificate like this:

openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -out test.pem -outform PEM -keyout test_key.pem -subj "/CN=user" -extensions v3_req_client -config openssl.conf -verbose

the resulting certificate has the subject alternative names: ... X509v3 extensions: X509v3 Extended Key Usage: TLS Web Client Authentication X509v3 Subject Alternative Name: othername:

but how i can just get a CSR with the SAN? what is missing in my csr request command to have it?

I am running CentOS Linux release 8.0.1905 (Core) with openssl version 1.1.1 FIPS

note I do not consider this to be a duplicate of: Missing X509 extensions with an openssl-generated certificate as the SAN is not even in the CSR

1
[v3_req_client]
extendedKeyUsage = clientAuth
subjectAltName = @alt_names

This section is not referenced anywhere. It will not be magically be used either. You have to explicitly provide what it should be used for, same as you did for [req_distinguished_name] with distinguished_name = req_distinguished_name:

req_extensions = v3_req_client
| improve this answer | |
  • why it does not work when adding this to the command line: -extensions v3_req_client – danidar May 22 at 14:22
  • @danidar: Because you have to use -reqexts instead. -extensions is for x509 extensions in the certificate. – Steffen Ullrich May 22 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.