Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

OpenSSL certificate authority (CA) - how to copy x509 extensions from CSR to signed PEM

How to copy x509 extensions from CSR to signed PEM with OpenSSL

Edit openssl.cnf, go to the authority section, my case "[ CA_default ]" and uncomment the following line:


This is often required for x509 extension Subject Alternative Name. SubjectAltName is a x509 extension that permits various literal values to be included in the signed certificate. It is used for ipsec VPNs, more precisely for IKE Phase 1 authentication.

Ipsec Ike phase1 authentication is performed against EMAIL, DNS, IP or DIRNAME subject alternative names. In many cases, this is set by the certificate authority that signs the certificate, overwriting what is sent in the signing request, but in some cases, it is desired to copy these extensions from the signing request as they were added by the initiator of the request.