6

I know that by adding/modifying the SubjectAltName entry in openssl.cnf this can be achieved, but is there a way to do so without having to modify that file every time?

5

You don't have to mess around with the openssl.cnf file in any way.

The following command demonstrates how to generate a self-signed certificate with SAN for the email nobody@example.com:

openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
  -keyout example.key -out example.crt -subj '/CN=Nobody' \
  -extensions san \
  -config <(echo '[req]'; echo 'distinguished_name=req';
            echo '[san]'; echo 'subjectAltName=email:nobody@example.com')

The trick here is to include a minimal [req] section that is good enough for OpenSSL to get along without its main openssl.cnf file.

In OpenSSL ≥ 1.1.1, this can be shortened to:

openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
  -keyout example.key -out example.crt -subj '/CN=Nobody' \
  -addext 'subjectAltName=email:nobody@example.com'

Here we are using the new -addext option, so we don't need -extensions and -config anymore.

Don't forget to verify the contents of the generated certificate:

openssl x509 -noout -text -in example.crt

See also: https://security.stackexchange.com/a/198409/133603 and https://stackoverflow.com/a/41366949/19163

1

In openssl.cnf at the top add the entry SAN = "email:copy" (to have a default value in case the environment variable SAN is not set) and in the respective section use SubjectAltName = ${ENV::SAN}. Now just call SAN="email:copy, email:adress@two" openssl ..., where email:copy makes sure the main address is used as well. (Adapted from here)

  • note to self: If your only access is via SSH, make sure your openssl.conf is valid. The simplest check is trying to establish a second connection (or scp something) without cutting the first one – Tobias Kienzler Mar 12 '13 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.