Also verify the Signature Algorithm is sha256WithRSAEncryption. Subject is the distinguished name of your certificate and requested extensions should have the X509v3 Subject Alternative Name block. Some CAs might only need CN (CommonName) and some might require additional fields like emailAddress. Requirements for the dn fields vary per certificate authority(CA) and level of validation.

dn (distinguished name) is the unique name of your certificate and it contains multiple fields like C = Country, ST = State and CN = CommonName which is also used to match the hostname.More options at /docs - Subject alternative name subjectAltName with two DNS names and one IP address.domain=įollowing two variables will be passed to the openssl command when generating the CSR. įire up a terminal and start by generating a 4096 bit RSA keyfile in case you don't have one (bash variable substitution). Or skip everything below and use a script from. and ) or even combine multiple wildcards (eg. SAN extension in short can be used to validate multiple hostnames with the same certificate (eg. I will tiptoe through generating a certificate signing request (csr) with openssl which includes X509 extension Subject Alternative Names (SAN).

Openssl subject alternative name