Subject Alternative Names (SAN)
Add Additional Domains to a Certificate
Section titled “Add Additional Domains to a Certificate”To add additional domains to a certificate, please use the SAN - extension for a CSR AND submit the required domains in the AddCertificate/ReissueCertificate - command. The domains submitted via command and included in the CSR will be compared and any difference will result in a failing request. The order of domains is not important and the matching is not case-sensitive. You can use the CheckCertificate command to check the SAN in your CSR.
AddCertificate
Section titled “AddCertificate”command=AddCertificatecsrX=...[...]domain0=example.netdomain1=www.example.netdomain2=www.example.comdomain3=mail.example.comGenerating a CSR Including SAN With OpenSSL
Section titled “Generating a CSR Including SAN With OpenSSL”To create a CSR containing SAN with OpenSSL, you need to create a config containing the “alt_names” - extension as shown below (using example.cnf)
HOME = .RANDFILE = $ENV::HOME/.rnd
[req]default_bits = 2048default_keyfile = privkey.pemdistinguished_name = req_distinguished_nameattributes = req_attributesx509_extensions = v3_reqstring_mask = nombstrreq_extensions = v3_reqdefault_md = sha256
[req_distinguished_name]countryName = Country Name (2 letter code)countryName_default = DEcountryName_min = 2countryName_max = 2
stateOrProvinceName = State or Province Name (full name)stateOrProvinceName_default = Test state
localityName = Locality Name (eg, city)localityName_default = Test town
0.organizationName = Organization Name (eg, company)0.organizationName_default = Testing Ltd.
organizationalUnitName = Organizational Unit Name (eg, section)organizationalUnitName_default = Test department
commonName = Common Name (eg, YOUR name)commonName_max = 64commonName_default = www.example.com
emailAddress = Email AddressemailAddress_max = 64emailAddress_default = [email protected]
[v3_req]basicConstraints = CA:FALSEkeyUsage = nonRepudiation, digitalSignature, keyEnciphermentsubjectAltName = @alt_names
[alt_names]DNS.1 = example.netDNS.2 = www.example.netDNS.3 = www.example.comDNS.4 = mail.example.comThis file can now be used with this openssl command to create a new CSR: The resulting content of example.csr can then be used in CheckCertificate, AddCertificate or ReissueCertificate by using the CSR# parameter (every line in the CSR a new numbered parameter).
openssl req -new [-nodes] [-sha256] -keyout example.key -out example.csr -config example.cnfOrdering a Certificate With Subject Alternative Names
Section titled “Ordering a Certificate With Subject Alternative Names”To include multiple domains in 1 certificate, Subject Alternative Names (SAN) can be used. For this, the domainX - parameters must match the SAN - extension in the CSR (See details in the introduction).
command=AddCertificatecsr0=-----BEGIN CERTIFICATE REQUEST-----csr1=MIIC9DCCAdwCAQAwga4xCzAJBgNVBAYTAkRFMRswGQYDVQQIExJSaGluZWxhbmQtcsr2=UGFsYXRpbmUxFDASBgNVBAcTC011c3RlcnN0YWR0MRQwEgYDVQQKEwtNdXN0ZXJmcsr3=aXJtYTEdMBsGA1UECxMUVGVjaG5pY2FsIGRlcGFydG1lbnQxFDASBgNVBAMTC2V4csr4=YW1wbGUuY29tMSEwHwYJKoZIhvcNAQkBFhJtdXN0ZXJAZXhhbXBsZS5jb20wggEicsr5=MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDNfuchcGp4dbz++86IT9dhN9DTcsr6=Wt3ll8bDlLBkntHVIUcBPNl0QwX3WSM1Oc1Xf8VuDvk8ywlj0KC8kEtBMdwDBONgcsr7=K+c0QcXTjebFd5Az5ExUiAytUvficVccDzpPIojcht4/pZoYtwDA7ZLxegT50fe6csr8=qiFUkT1O9NGIZIfHooh2wFzRN92UXb2L08zuNv6+He6OAPoAA9JgmlY+MDD0Nwrjcsr9=n6dWKv8RZ8ffBLevdKivYMvZWD+z5FF/T43UMQ2Zu+4oYYx/o2Zq0IKormHGTydqcsr10=h1Cxy4zmhdRYkY/ISXDhUrZB/PNL30eWnUQrOk074jrAw+27HtFI1iTaVXwPAgMBcsr11=AAGgADANBgkqhkiG9w0BAQUFAAOCAQEAjr3iAQIYN2F3XFj2t3x818wLbmnIkuL3csr12=KW96PfGs/c6IQbLcdauPrLly+rZIWwic0/TKgGV3A9mQM/V2Bip6b50l7AEWSdiLcsr13=8wq3B9kQN24XA19E0YtILuBBFIcnAEvB70xWKdYn1y0gBnepgIGJ56ecxpFK2QBYcsr14=3flMV6puvRIXatB4g6UeEO4aekBsVnPC8wIQSn6ioZ5SOlzXGHOtE5deuJt4LMtncsr15=KNaA4vhGW3ogflle4Dnf9HILsd41KNfOLS+f2adBq6eXJpAydVbEHW2qU9/TNGHKcsr16=imMq0DwFaRVWh29FKXqEFJJN5KjtGfCoKj9rIC/TOMgeq+2XIUyxzA==csr17=-----END CERTIFICATE REQUEST-----ownercontact0=P-ABC1admincontact0=P-ABC1techcontact0=P-ABC1billingcontact0=P-ABC1webservertype=apache2class=TRUEBIZIDdomain0=example.netdomain1=www.example.netdomain2=www.example.comdomain3=mail.example.comcode = 200description = Command completed successfullyproperty[billingclass][0] = truebizid-4sanproperty[certificate][0] = SA1234567property[status][0] = REQUESTEDproperty[sub][0] = SA1234567-001property[sub status][0] = ORDER_REQUESTEDEOF