# CSR for SAN cert

**URL:** <https://community.letsencrypt.org/t/csr-for-san-cert/67762>\
**Category:** Help\
**Created:** [July 26, 2018, 6:44pm UTC](https://community.letsencrypt.org/t/csr-for-san-cert/67762 "2018-07-26T18:44:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ivasilyev](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ivasilyev/32/25040_2.png) [@ivasilyev](https://community.letsencrypt.org/u/ivasilyev)\
**Post date:** [July 26, 2018, 6:44pm UTC](https://community.letsencrypt.org/t/csr-for-san-cert/67762/1 "2018-07-26T18:44:20Z")

</div>

Hi

I need to generate multi-domain wildcard certificate for domains \*.domain1.com and \*.domain2.com. I’m not sure how CSR should look. Should it have Common Name field filled, and with what value? I’m having problems finalizing an order. In particular, I’m using Certes client.

TIA  
Ivan

---

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [July 26, 2018, 6:46pm UTC](https://community.letsencrypt.org/t/csr-for-san-cert/67762/2 "2018-07-26T18:46:08Z")

</div>

Hi,

You should at least set one domain in the common name fields…

and all domains you wish to include listed in Subject Alternative Names field…

**Please Note** that if you also want to secure the root domain, you will also include that in the CSR (since wildcard **does not** include root domain)

Thank you

P.S. Here’s a sample CSR: (Only domains are actually required & need to be precise, since LE **only** provide DV certificate)

- ----BEGIN CERTIFICATE REQUEST-----  
MIIDOzCCAiMCAQAwgZ8xFTATBgNVBAgMDFNhbXBsZSBTdGF0ZTELMAkGA1UECwwC  
SVQxJTAjBgkqhkiG9w0BCQEWFmR1bW15ZW1haWxAZXhhbXBsZS5jb20xCzAJBgNV  
BAYTAlVTMRcwFQYDVQQKDA5TYW1wbGUgQ29tcGFueTEWMBQGA1UEAwwNKi5leGFt  
cGxlLmNvbTEUMBIGA1UEBwwLU2FtcGxlIENpdHkwggEiMA0GCSqGSIb3DQEBAQUA  
A4IBDwAwggEKAoIBAQClVHQQ6RVpS3nDImyFs2M/8XDiXvj8iWgokrir6trqW4dY  
kjU8pVxITQ48RMWh9IixxXWoUZC/Lz01ShcI78Pmq1hJlRzj8AeZypZtYUfuNQNE  
b86t4ARhlQXDQ7BUn1Q4agoH/lrQMn4tPKgPzM95R6QqLeqfSQOUmccpBTgJLo0P  
dM/YL8ES8lhYkABJM6/xHXdLaCqMjeB7+wNBBrItIUx+sMg0+bDCb4FbsbaqqF3Z  
pk2YkbISIQhAkb6jWmg8BqTBovOni/3CPFv89NN+/NAtDdBoV3Y6EgPLoyMsBHKu  
Xt8SscL2Oc+o1jt64WGlpMjfiVL9A7skrdztQuRzAgMBAAGgVjBUBgkqhkiG9w0B  
CQ4xRzBFMEMGA1UdEQQ8MDqCDSouZXhhbXBsZS5jb22CDiouZXhhbXBsZTEuY29t  
ggtleGFtcGxlLmNvbYIMZXhhbXBsZTEuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQB3  
SsopjmBnEEFPpdJ1azfElngu6ym4MvHBJm7m7NpT57wAtE9Nca4lC4Mf6O5h+AuH  
RoYtOlDHF30MvULjWwnJpxFLIb/o1PqF34cUJclBfAhyE6Qr6OxSZkTrCznNyzBl  
o+tKG7Ul19BGq+UifweNjFX7M2IkvXHBLU0nICAi2X0P1l2lrpHuw/9GybhcAPPq  
FKvR5vX30r+tWeGlkU4EgohdVmFwW3dkeJUlQtyXHGWfm2Jh54oMeemvatwfMxMg  
X2fU988XjvvWgROikbfSW77/8uGVHdaxvwAYnpSnkrXauAJ1ixSXJQA/Eh+siNCX  
BvZ1zJg9wzxm817V7dpa  
-----END CERTIFICATE REQUEST-----

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [July 26, 2018, 10:24pm UTC](https://community.letsencrypt.org/t/csr-for-san-cert/67762/3 "2018-07-26T22:24:23Z")

</div>

> [@stevenzhu](#):
>
> You should at least set one domain in the common name fields…

I think this is now optional from the CA's perspective; maybe @cpu could confirm this?

---

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [July 26, 2018, 10:48pm UTC](https://community.letsencrypt.org/t/csr-for-san-cert/67762/4 "2018-07-26T22:48:15Z")

</div>

> [@schoen](#):
>
> I think this is now optional from the CA’s perspective; maybe @cpu could confirm this?

That's true...

However, when generating CSRs, it's better to control what host is being displayed on common name field...

P.S. On the go system's certificate doesn't have a hostname on common name  
Just `Mutli-Domain certificate`

---

<div class="post-metadata">

**Author:** ![ivasilyev](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ivasilyev/32/25040_2.png) [@ivasilyev](https://community.letsencrypt.org/u/ivasilyev)\
**Post date:** [July 27, 2018, 2:23pm UTC](https://community.letsencrypt.org/t/csr-for-san-cert/67762/5 "2018-07-27T14:23:48Z")

</div>

Thanks everyone. I found nice feature in the Certes’ API that generates CSR from LE order. Under the hood the feature is doing exactly what you suggested, it sets CN = one of a wildcard domains and sets Subject Alt Name = a list of all wildcard domains.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [August 26, 2018, 2:23pm UTC](https://community.letsencrypt.org/t/csr-for-san-cert/67762/6 "2018-08-26T14:23:50Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.