OpenSSL CSR configuration for Subject Alternative Names (SAN)

Question

When generating a Certificate Signing Request (CSR) using the openssl req command, standard subject fields are handled via interactive prompts or a basic configuration file. However, modern browser requirements necessitate the inclusion of Subject Alternative Names (SANs) to ensure certificate validity across multiple DNS entries or IP addresses.

The goal is to integrate these extensions into the CSR generation process without manually editing the global openssl.cnf file for every unique request. While the -config flag allows for a custom configuration file, there is uncertainty regarding the most efficient way to pass dynamic SAN values during a scripted generation process in OpenSSL 3.x.

Is there a method to inject SAN extensions via the command line without a physical configuration file?
How does the req_extfile directive behave when multiple SAN entries are required for a single request?

Tasadduq Burney · Answer

Answer first
1. Yes – you can inject SAN extensions directly on the command line using the -addext option that OpenSSL 3.x introduced. 2. The req_extfile directive simply loads a separate file containing extension definitions; it does not interpret the number of SAN entries – you list all of them in the referenced section.

How to add SANs with -addext

Create a key if you don’t already have one:openssl genrsa -out key.pem 2048
  Generate the CSR, passing all SANs in one -addext argument (comma‑separated if you prefer):openssl req -new -key key.pem -subj "/CN=example.com" \
  -addext "subjectAltName = DNS:example.com, DNS:www.example.com, IP:192.0.2.1" \
  -out request.csr
  Verify the CSR contains the SANs:openssl req -text -noout -in request.csr | grep -A1 "Subject Alternative Name"

Using req_extfile for multiple SANs
The req_extfile option (or its synonym -extfile) tells OpenSSL to read a separate configuration file that defines extensions.  Inside that file you typically have a section like:
[alt_names]
DNS.1 = example.com
DNS.2 = www.example.com
IP.1   = 192.0.2.1

And in the main [req] section you reference it:
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req

[v3_req]
subjectAltName = @alt_names

When OpenSSL processes the CSR, it loads the file, substitutes the @alt_names reference, and includes all listed SAN entries.  The directive itself does not limit the number of entries – you simply keep adding DNS.n or IP.n lines as needed.

Older OpenSSL versions
If you’re on OpenSSL < 3.0, -addext is not available.  Instead you must use a configuration file (either inline with -config or via -extfile/req_extfile) and specify the subjectAltName in the req_extensions section.

Verification
After generating the CSR, run:openssl req -text -noout -in request.csrand confirm that the Subject Alternative Name field lists all desired entries.

Need more help?
Could you let me know which OpenSSL version you’re using?  The -addext option is only supported from 3.0 onward.

OpenSSL CSR configuration for Subject Alternative Names (SAN)

1 answer

1 question comment

Mixing -addext with a custom config

Answer first

How to add SANs with `-addext`

Using `req_extfile` for multiple SANs

Older OpenSSL versions

Verification

Need more help?

Your perspective belongs here.