1

Hi All

i want to generate csr and the below syntax works fine for me for the url(url1.contoso.com). i want to generate csr for two urls in the same csr. i.e for url1.contoso.com & url2.contoso.com
Please guide me with the syntax as i am getting error.

openssl req -new -subj “/C=Country/ST=State/L=Location/O=Contoso/CN=url1.contoso.com” -addext “subjectAltName = DNS:url1.contoso.com” -newkey rsa:2048 -keyout url.contoso.com-key.pem -out url.contoso.com.csr

openssl rsa -in url.contoso.com-key.pem -out url.contoso.com-key

12 Spice ups
2

To generate a CSR for a SAN certificate, this may be helpfull:

certificates - Provide subjectAltName to openssl directly on the command line - Information Security Stack Exchange

3

DNS.1 DNS.2 etc would be the correct syntax to address more FQDNs. The following example using a configuration file for generating the CSR but you should be familiar with the content, you are using more or less the same parameters in your command line.

https://www.ibm.com/docs/en/qsip/7.4?topic=sc-creating-multi-domain-san-ssl-certificate-signing-request
HTH Tom

1 Spice up
4

Hi,

You can just generate a wildcard CSR on your server, this will cover all subdomains/hosts.

HTH,

5

I would not recommend a wildcard certificate, because it is like a master key.

BTW: A correctly created wildcard certificate is also a SAN certificate:
*.domain.tld
domain.tld

:slight_smile:

6

You’ve asked how to generate CSRs many times on here in the past and my advice back then was to generate it via IIS/MMC on Windows if you are more familiar with it, complete the CSR and import it back in to the windows box.

You are then free to export it to PFX for Windows or cert/key for Apache.

Some of your previous requests above, may help.

2 Spice ups
7

I wrote up some instructions for creating SSL certificate requests and some tips as I have to replace about 30 SSL certificates per year. This process is used for all SSL certificates including Windows, Linux and other devices. I chose to use OpenSSL to create the request and convert the certificates. It’s fairly easy once you have the steps. I hope this helps someone:

Create CNF configuration file on your Linux workstation or PC with OpenSSL installed:
(Create a temporary folder and put the file in it…then run the commands below from that folder.)

Sample file below:
____________________________________________________________

[req]
    distinguished_name = req_distinguished_name
    req_extensions = v3_req
    prompt = no
    [req_distinguished_name]
    C = US
    ST = VA
    L = YourTown
    OU = Your Department
    O = My Company
    CN = host.company.com
    [v3_req]
    keyUsage = keyEncipherment, dataEncipherment
    extendedKeyUsage = serverAuth
    subjectAltName = @alt_names
    [alt_names]
    DNS.1 = host.company.com
    DNS.2 = host2.company.com

____________________________________________________________

Create Certificate Request with .cnf file specs:
openssl req -config host.company.com.cnf -newkey rsa:4096 -nodes -sha256 -keyout host.company.com.key -out host.company.com.csr

Check SAN Entries:
openssl req -noout -text -in host.company.com.csr | grep DNS

Process certificate request on DigiCert's website or with Windows Certificate Services and download the new certificate files.

Chain the Root and Intermediate certificates if needed:
Open the DigiCertCA.crt and the TrustedRoot.crt files with Notepad and add them to a new empty text file called certchain.txt
The Root certificate stays at the top of the text file and the intermediate certs can be added below.  Rename the file certchain.crt
This will help with the next section as you convert the certificates to a single PFX file.  (Not needed for most Linux certificates.)

Create Single PFX file with all certificates chained and a password:
openssl pkcs12 -export -out host.company.com.pfx -inkey host.company.com.key -in host.company.crt -certfile certchain.crt -name Host2023.company.com  (Give the PFX file a password.)

Copy the PFX or the other the Crt, Key or Root Crt files to a temporary folder on your hard drive or on the server.
The Windows Servers and many devices will take a single PFX file with all certificates chained.  (Be sure to remember the password for the PFX file.)  
It is easy to import the single .pfx file to the local server Windows Certificate Store.

The Linux Servers will usually want an individual ".key" file, an individual ".crt" file and the root ".crt" file.
Most of the time the "apache.conf" file specifies where the new files need to be located
8

Try OpenSSL for this.

openssl req -new -subj "/C=Country/ST=State/L=Location/O=Contoso/CN=url1.contoso.com" -addext "subjectAltName = DNS:url1.contoso.com,DNS:url2.contoso.com" -newkey rsa:2048 -keyout url.contoso.com-key.pem -out url.contoso.com.csr