3

I have set myself up as a Certicate Authority so I can sign certificates I need for development. I have imported my CA certificate in my browsers so certificates I sign are accepted without question

As NOT the CA, I made myself a Certificate Signing Request containing a Common Name for one internal domain name, and added about 10 other (internal) domain names with the objective of having myself as CA sign it. The CSR has those names - I can see them when I look at it.

I signed the certificate as CA, using my own openssl.cnf file that I normal use for my single domain certificates and it appears to have stipped out all the AltSubjectNames, so the signed certificate I have produced is only good for the one domain in the CN field. My browsers complain when I try and use it for one of the other domains.

I think I need to adjust the extension in my CAs openssl.cnf file to not strip them out. The man page for CA points me at the man page for x509v3_config. But the reading of this is obscure and I can't figure out what to do.

Searching the internet for solutions came up with nothing - there are plenty of descriptions as to how to get the CSR, but absolutely nothing about how a CA can carry over the AltSubjectNames in the CSR into the final Certificate.

How is it done?

1 Answer 1

Reset to default
2

I eventually found an answer.

The CA_default section of the CA's openssl.cnf file should contain

copy_entensions = copy

Then extensions in the request are copied to the certificate.

It doesn't appear possible to limit this to only subjectAltName entries.

1
  • 1
    If you have an extension configured in your CSR and also in the CA's configuration, the CA's will take precedence. You can use that to limit some values. Of course, as a CA, you should check all requests before approving them and simply reject those who don't adhere to your policies ;-)
    – garethTheRed
    Jan 27, 2016 at 19:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .