Generate a SAN certificate with OpenSSL
Create a certificate request that covers several DNS names and IP addresses with an OpenSSL configuration file, then convert the signed certificate to PFX for Windows.
Infrastructure Cybersecurity linux security openssl pkiContents
A SAN (Subject Alternative Name) certificate protects several domain names, aliases or IP addresses with a single certificate. Browsers such as Chrome now require the names to be in the SAN field, and Apple limits the lifetime of publicly trusted certificates to 398 days, a rule most of the industry has adopted.
The commands below are for Linux, but they work just as well on Windows with OpenSSL installed, or with the Windows Subsystem for Linux (WSL).
The files involved
- A CSR (certificate signing request) is what you send to a certificate authority (CA) to obtain a certificate. It contains your public key and information about the site and the organisation, such as the domain names and the organisation’s name.
- A CER or CRT file is the certificate the CA issues in response. It contains the public key and the details from the request, signed by the CA, and is installed on the server.
- A KEY file is the private key generated along with the CSR. The server uses it to prove that it owns the certificate when a browser connects. Keep it private and never share it.
The configuration file
I keep all the details in a file called certificate.conf:
[req]sets up the request itself.[req_distinguished_name]describes your organisation: country, state, city, organisation name and so on.[v3_req]sets the key usage and extended key usage.[alt_names]lists every DNS name and IP address the certificate must cover.
Use this as a template and adapt it:
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = CH
ST = VD
L = Lausanne
O = BoringLab
OU = IT
CN = mycert.boringlab.ch
[v3_req]
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = mycert.boringlab.ch
DNS.2 = myalias1.boringlab.ch
DNS.3 = myalias2.boringlab.ch
IP.1 = 10.10.10.10
IP.2 = 192.168.10.10C must be a two-letter country code; a Microsoft CA rejects anything else with
error 0x80094001.
Create the request
Generate the key and the CSR in one command. Use a strong hash algorithm such as SHA-256, never SHA-1.
openssl req -new -out mycert.csr -newkey rsa:4096 -nodes -sha256 -keyout mycert.key -config certificate.confPrint the request to paste it into your CA’s request form:
cat mycert.csrSend it to your internal CA. A public CA only signs requests for public domain names that you own, or whose owner approves the request, and never for private IP addresses.
Convert the certificate to PFX for Windows
Windows usually wants the certificate and its private key together in a PFX file:
openssl pkcs12 -export -out mycert.pfx -inkey mycert.key -in mycert.crtmycert.pfxis the file to create;mycert.keyis the private key;mycert.crtis the certificate issued by the CA.