5

I need to setup https for multiple domians xxxx.com xxxx.net (with single common certificate)

CA where we buying certificate ask to create Certificate Signing Request (CSR), but when I'm generating it with openssl - it asks only for one name

how to make one CSR for multiple domains ?

7
  • 1
    A little Googling got me this. Dec 15, 2011 at 8:36
  • @LinusKleen: Will that result in a single certificate with multiple domains in it? Is that even possible? Or will you get multiple certificates (using the same private key)?
    – Thilo
    Dec 15, 2011 at 8:43
  • It's possible, @Thilo. It's a single certificate with its subject containing multiple CNs. Dec 15, 2011 at 8:44
  • Do all browsers like that? Any examples in the wild?
    – Thilo
    Dec 15, 2011 at 8:54
  • @Thilo Yes, my site has one, for example. Multi-Domain certificates aren't that new and supported by all major browsers. Dec 15, 2011 at 9:24

1 Answer 1

13

Avoid certificates with multiple CNs (as suggested in comments), that's not how the specifications (RFC 2818 and RFC 6125) say it should work and, although it may work in some clients applications, it will usually fail. From RFC 2818:

If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead.

Instead, generate certificates (or CSR) with multiple Subject Alternative Names (SANs).

If you're using OpenSSL, edit your openssl.cnf (or edit a copy) and set these properties, in the relevant sections ([req] and [ v3_req ]):

[req]
req_extensions = v3_req

[v3_req]
subjectAltName=DNS:www.example1.com,DNS:www.example2.com,DNS:www.example3.com

There's also a nice trick to use an environment variable for this (rather in than fixing it in a configuration file) here: http://www.crsr.net/Notes/SSL.html

You may also want to have one of them (any) in the CN.

(You may also be interested in this answer.)

1
  • FTR if you use XCA, it's under Extensions > X509v3 Subject Alternative Name when creating a cert. Thanks!
    – Yajo
    Mar 20, 2017 at 10:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.