Question
OpenSSL CSR configuration for Subject Alternative Names (SAN)
Neel Nova
0 reputation · 28 Mar 2025, 15:20 UTC
112.6K views
Loading…
0 reputation · 28 Mar 2025, 15:20 UTC
When generating a Certificate Signing Request (CSR) using the openssl req command, standard subject fields are handled via interactive prompts or a basic configuration file. However, modern browser requirements necessitate the inclusion of Subject Alternative Names (SANs) to ensure certificate validity across multiple DNS entries or IP addresses.
The goal is to integrate these extensions into the CSR generation process without manually editing the global openssl.cnf file for every unique request. While the -config flag allows for a custom configuration file, there is uncertainty regarding the most efficient way to pass dynamic SAN values during a scripted generation process in OpenSSL 3.x.
req_extfile directive behave when multiple SAN entries are required for a single request?35275 reputation · 28 Mar 2025, 16:28 UTC
1. Yes – you can inject SAN extensions directly on the command line using the -addext option that OpenSSL 3.x introduced. 2. The req_extfile directive simply loads a separate file containing extension definitions; it does not interpret the number of SAN entries – you list all of them in the referenced section.
openssl-addextopenssl genrsa -out key.pem 2048-addext argument (comma‑separated if you prefer):openssl req -new -key key.pem -subj "/CN=example.com" \
-addext "subjectAltName = DNS:example.com, DNS:www.example.com, IP:192.0.2.1" \
-out request.csropenssl req -text -noout -in request.csr | grep -A1 "Subject Alternative Name"req_extfile for multiple SANsThe req_extfile option (or its synonym -extfile) tells OpenSSL to read a separate configuration file that defines extensions. Inside that file you typically have a section like:
[alt_names]
DNS.1 = example.com
DNS.2 = www.example.com
IP.1 = 192.0.2.1
And in the main [req] section you reference it:
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
[v3_req]
subjectAltName = @alt_names
When OpenSSL processes the CSR, it loads the file, substitutes the @alt_names reference, and includes all listed SAN entries. The directive itself does not limit the number of entries – you simply keep adding DNS.n or IP.n lines as needed.
If you’re on OpenSSL < 3.0, -addext is not available. Instead you must use a configuration file (either inline with -config or via -extfile/req_extfile) and specify the subjectAltName in the req_extensions section.
After generating the CSR, run:openssl req -text -noout -in request.csr
and confirm that the Subject Alternative Name field lists all desired entries.
Could you let me know which OpenSSL version you’re using? The -addext option is only supported from 3.0 onward.
Use comments to ask for clarification. Post a solution as an answer.
35,275 reputation · 28 Mar 2025, 19:07 UTC
If you already supply a configuration file that defines req_extensions, you can still add SANs on the command line with -addext. The value passed to -addext is appended to the extensions list; it does not replace what is already defined in the config.
-config file to load your standard fields.req_extensions = v3_req in the [req] section.-addext "subjectAltName=DNS:example.com,IP:192.0.2.1".Some pitfalls to avoid:
subjectaltname will be ignored.alt_names section, -addext does not merge them; you’ll end up with duplicate entries unless you remove the config reference.When in doubt, generate the CSR with -addext only, then inspect it with openssl req -text -noout -in request.csr to confirm the SANs are present.