We have an internal/private PKI that issues certificates so only the employees of the company can access some subdomains (for example admin.example.com).
Here is the script we used to generate the certificates:
names="john maria foo bar" for name in $names; do echo "$name" openssl genrsa -aes256 -out $name.key 2048 # Creating the certificate signing request openssl req -new -key $name.key -out $name.csr # Signing the certificate openssl ca -in $name.csr -out $name.crt # Exporting both the key and the certificate in a p12 file openssl pkcs12 -export -clcerts -in $name.crt -inkey $name.key -out $name.p12 # And now a bit of cleaning rm $name.csr done
The script generates a .key , .crt and .p12 files for each employee, the employee can then add his p12 file to his browser (along with the company's CA Root certificate) to access the subdomain.
But recently, it wasn't working anymore with chrome, apparently there has been an update and we need to have SANs (Subject Alt Names) in the personals certificates used by the employees.
Following FAQ/subjectAltName (SAN), I modified the OpenSSL configuration file:
[req] req_extensions = v3_req [ v3_req ] # Extensions to add to a certificate request basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [alt_names] DNS.1 = admin.example.com DNS.2 = admindashboard.example.com
but the resulting certificate didn't contain the SANs.
I removed the last part of the script which destroyed the .csr file, relaunched the script and tested a csr file with the command
openssl req -text -noout -in john.csr | grep DNS
At this point it seems to work since I got
as a result.
But when I test the crt file with
openssl x509 -text -noout -in john.crt | grep DNS
I get nothing.
Am I missing something ?