Multi tool use

how to keep SubjectAltName as as commonName in openssl conf file

I am working on building a Certificate Authority on my centos server. I have completed the setup following OpenSSL Cookbook (great stuff) from https://www.feistyduck.com/books/openssl-cookbook/ The concepts explained in the book and procedure is very simple and worked like charm. However, I feel it was a bit outdated and chrome browser changed the behavior to require Subject Alternative Name otherwise it gives browser warning even though the certificate is perfectly valid.

https://www.feistyduck.com/books/openssl-cookbook/

After reading the documentation at https://www.openssl.org/docs/man1.0.2/apps/x509v3_config.html#Subject-Alternative-Name I could understand that I need to include that in my conf file of root CA and sub-ca (intermdiate Certificate Authority).

https://www.openssl.org/docs/man1.0.2/apps/x509v3_config.html#Subject-Alternative-Name

Now what I want to do is to use the commonName as SAN. That means instead of hardcoding SAN, I want to take whatever the value I get from CSR for CommonName and use that as SAN.
What should I put in conf file to achieve this?
I tried to put
subjectAltName = $commonName
and it is telling me that it is not a valid way of defining SAN.

Here is my actual conf file

https://pastebin.com/UtCDU4BE


2 Answers
2

This answer might help https://security.stackexchange.com/a/91556. As @Jon already mentioned. It's only possible with the help of a template.
Make sure you validated the input. Otherwise someone can inject a new line into the DNS name.
An other solution to the problem could be to use https://github.com/cloudflare/cfssl or https://github.com/google/easypki instead.

Unfortunately, the OpenSSL conf files aren't at all sophisticated, and it isn't possible to refer to previously declared names.

I think the usual approach is to write a short script which can fill in a template conf file. It's certainly what I've done in the past.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.