Re: [PLUG] openssl and specifying subjectAltName

[brent timothy saner via plug <plug@lists.phillylinux.org>]

On 2/5/20 12:48, Michael Leone wrote:
> 
> 
> We *are* the CA. These are internal certs, signed by our internal Linux CA.

When I say "the CA", I'm operating under the assumption that you control
both the CA and requester(s). But either way, it wouldn't matter; I'm
speaking about general X.509 structure here.

> 
>     But long story short, yes, 
> 
> 
> FYI, you could have just started with this. :)

I did.

"> Is that doable? I haven't seen how ...

nope; you haven't seen it because it isn't doable. OpenSSL expects a
static environment."

"The openssl.cnf syntax has a .include directive[0], but you're still
going to be manually editing a config if you want a different set of SANs."

If you don't want to manually edit for each request, assuming you still
want to add the SANs on the CA side, either you need to use some
programmatic method of generating CSRs, or use something that will
generate the CSRs for you like Vault.

If you include the SANs in the CSR itself instead, each requester just
needs its own static configuration of CN/SANs.

> 
>     those SANs need to be present in the
>     openssl.cnf if you're using openssl in some form or another, either via
>     an .include or what have you - as I originally stated.
> 
>     But the SANs should really be present in the CSR itself and approved by
>     the CA, not added by the CA.
> 
> 
> "Should be", yes. In really, not always.
> 


If you control the CSR generation, there's no reason why it can't be in
the CSR as per best-practices based on the information you've given.

Attachment: signature.asc
Description: OpenPGP digital signature

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug