I have set myself up as a Certicate Authority so I can sign certificates I need for development. I have imported my CA certificate in my browsers so certificates I sign are accepted without question

As NOT the CA, I made myself a Certificate Signing Request containing a Common Name for one internal domain name, and added about 10 other (internal) domain names with the objective of having myself as CA sign it. The CSR has those names - I can see them when I look at it.

I signed the certificate as CA, using my own openssl.cnf file that I normal use for my single domain certificates and it appears to have stipped out all the AltSubjectNames, so the signed certificate I have produced is only good for the one domain in the CN field. My browsers complain when I try and use it for one of the other domains.

I think I need to adjust the extension in my CAs openssl.cnf file to not strip them out. The man page for CA points me at the man page for x509v3_config. But the reading of this is obscure and I can't figure out what to do.

Searching the internet for solutions came up with nothing - there are plenty of descriptions as to how to get the CSR, but absolutely nothing about how a CA can carry over the AltSubjectNames in the CSR into the final Certificate.

How is it done?

up vote 3 down vote accepted

I eventually found an answer.

The CA_default section of the CA's openssl.cnf file should contain

copy_entensions = copy

Then extensions in the request are copied to the certificate.

It doesn't appear possible to limit this to only subjectAltName entries.

  • 1
    If you have an extension configured in your CSR and also in the CA's configuration, the CA's will take precedence. You can use that to limit some values. Of course, as a CA, you should check all requests before approving them and simply reject those who don't adhere to your policies ;-) – garethTheRed Jan 27 '16 at 19:05

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.