ssl - How can I generate a self-signed certificate with SubjectAltName using OpenSSL? -


i trying generate self-signed certificate openssl subjectaltname in it.while generating csr certificate, guess have use v3 extensions of openssl x509. using :

openssl req -new -x509 -v3 -key private.key -out certificate.pem -days 730

can me exact syntax?

can me exact syntax?

its 3 step process, , involves modifying openssl.cnf file. might able command line options, don't way.

find openssl.cnf file. located in /usr/lib/ssl/openssl.cnf:

$ find /usr/lib -name openssl.cnf /usr/lib/openssl.cnf /usr/lib/openssh/openssl.cnf /usr/lib/ssl/openssl.cnf

on debian system, /usr/lib/ssl/openssl.cnf used built-in openssl program. on recent debian systems located @ /etc/ssl/openssl.cnf

you can determine openssl.cnf being used adding spurious xxx file , see if openssl chokes.

first, modify req parameters. add alternate_names section openssl.cnf names want use. there no existing alternate_names sections, not matter add it.

[ alternate_names ]  dns.1        = example.com dns.2        = www.example.com dns.3        = mail.example.com dns.4        = ftp.example.com

next, add following existing [ v3_ca ] section. search exact string [ v3_ca ]:

subjectaltname      = @alternate_names

you might change keyusage following under [ v3_ca ]:

keyusage = digitalsignature, keyencipherment

digitalsignature , keyencipherment standard faire server certificate. don't worry nonrepudiation. useless bit thought comp sci guys wanted lawyers. means nothing in legal world.

in end, ietf (rfc 5280), browsers , cas run fast , loose, not matter key usage provide.

second, modify signing parameters. find line under ca_default section:

# extension copying option: use caution. # copy_extensions = copy

and change to:

# extension copying option: use caution. copy_extensions = copy

this ensures sans copied certificate. other ways copy dns names broken.

third, generate self-signed:

$ openssl genrsa -out private.key 3072 $ openssl req -new -x509 -key private.key -sha256 -out certificate.pem -days 730 asked enter information incorporated certificate request. enter called distinguished name or dn. ...

finally, examine certificate:

$ openssl x509 -in certificate.pem -text -noout certificate:     data:         version: 3 (0x2)         serial number: 9647297427330319047 (0x85e215e5869042c7)     signature algorithm: sha256withrsaencryption         issuer: c=us, st=md, l=baltimore, o=test ca, limited, cn=test ca/emailaddress=test@example.com         validity             not before: feb  1 05:23:05 2014 gmt             not after : feb  1 05:23:05 2016 gmt         subject: c=us, st=md, l=baltimore, o=test ca, limited, cn=test ca/emailaddress=test@example.com         subject public key info:             public key algorithm: rsaencryption                 public-key: (3072 bit)                 modulus:                     00:e2:e9:0e:9a:b8:52:d4:91:cf:ed:33:53:8e:35:                     ...                     d6:7d:ed:67:44:c3:65:38:5d:6c:94:e5:98:ab:8c:                     72:1c:45:92:2c:88:a9:be:0b:f9                 exponent: 65537 (0x10001)         x509v3 extensions:             x509v3 subject key identifier:                  34:66:39:7c:ec:8b:70:80:9e:6f:95:89:db:b5:b9:b8:d8:f8:af:a4             x509v3 authority key identifier:                  keyid:34:66:39:7c:ec:8b:70:80:9e:6f:95:89:db:b5:b9:b8:d8:f8:af:a4              x509v3 basic constraints: critical                 ca:false             x509v3 key usage:                  digital signature, non repudiation, key encipherment, certificate sign             x509v3 subject alternative name:                  dns:example.com, dns:www.example.com, dns:mail.example.com, dns:ftp.example.com     signature algorithm: sha256withrsaencryption          3b:28:fc:e3:b5:43:5a:d2:a0:b8:01:9b:fa:26:47:8e:5c:b7:          ...          71:21:b9:1f:fa:30:19:8b:be:d2:19:5a:84:6c:81:82:95:ef:          8b:0a:bd:65:03:d1

-

Comments

Post a Comment

Popular posts from this blog

php - regexp cyrillic filename not matches -

i take list of files php glob(."*.pdf") . files have cyrillic names. example: ООО «Рога и копыта» then load company names database , try find them in file names: preg_match("/$firm_name/ui", $file_name, $match); i have problem: firms if $firm_name visually similar $file_name , preg_match says there no match. mb_detect_encoding both variables return utf-8. there problem in file name, or maybe there encoding or something, can not understand, ask help. upd: $file_name='ООО «Рога и копыта»'; preg_match("/... .Рога и копыта./ui", $file_name, $match); as result, ОО «Рога и копыта» , 1 О missing
Read more

c# - OpenXML hanging while writing elements -

Image
i have program pulls data database, caches file , exports data multiple formats (excel, excel 2003, csv). i'm using openxml sdk 2.0 excel work. these export processes run in parallel (using parallel.foreach ), , amount of data can pretty large - e.g. csvs 800mb. during these larger exports, i've noticed writing of xml documents hang. instance, if have 8 exporting in parallel, @ point "pause". hang around same point: //this.writer openxmlwriter created worksheetpart. this.writer.writeelement(new cell() { cellvalue = new cellvalue(value), datatype = cellvalues.string }); when happens, pause debugger (vs2013 in case) , notice threads blocking around same portion of code - bit deeper in openxml sdk - stem call openxmlwriter.writeelement . i dug through source using justdecompile didn't find answers. appears there intermediary stream in use writing isolated storage , is, reason, blocking. underlying stream each of these filestream . here screenshot ...
Read more

sql - Select Query has unexpected multiple records (MS Access) -

i may tired, can't seem figure out happening. have 2 queries. query 1 has 10 fields. query 2 has 5 fields. fields 1 through 3 same in both queries. trying write select query , simple add field 5 query2 query1 result should query1 additional field (query2.field5). i join first 3 fields both queries , choose select records in query1 , in query2 match. don't know sql, use query designer. expect same number of records have query 1 instead have 3 times or more. can tell me doing wrong. tried reversing joins still seem same records. thanks in advance. here query: the fields in common divisionname , supplierid = vendorid , commodityname . select [part revenue exposed query p1].divisionname, [part revenue exposed query p1].commodityname, [part revenue exposed query p1].suppliername, [part revenue exposed query p1].partnumber, [part revenue exposed query p1].partdescription, [part revenue exposed query p1].bucode, ...
Read more