# Error EXT \[Making and trusting your own certificates\]

**URL:** <https://community.letsencrypt.org/t/error-ext-making-and-trusting-your-own-certificates/120333>\
**Category:** Help\
**Created:** [April 22, 2020, 6:41am UTC](https://community.letsencrypt.org/t/error-ext-making-and-trusting-your-own-certificates/120333 "2020-04-22T06:41:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![JNB\_Dimo](https://avatars.discourse-cdn.com/v4/letter/j/49beb7/32.png) [@JNB\_Dimo](https://community.letsencrypt.org/u/JNB_Dimo)\
**Post date:** [April 22, 2020, 6:41am UTC](https://community.letsencrypt.org/t/error-ext-making-and-trusting-your-own-certificates/120333/1 "2020-04-22T06:41:44Z")

</div>

My domain is:  
localhost

I ran this command (1) :  
openssl req -x509 -out localhost.crt -keyout localhost.key -newkey rsa:2048 -nodes -sha256 -subj ‘/CN=localhost’ -extensions EXT -config \<(printf “[dn]\nCN=localhost\n[req]\ndistinguished\_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth”)

It produced this output (1):  
Error in req

I ran this command (2) :  
openssl req -x509 -out localhost.crt -keyout localhost.key -newkey rsa:2048 -nodes -sha256 -subj ‘/CN=localhost’ -extensions EXT

It produced this output (2):  
Error Loading extension section EXT

The operating system my web server runs on is (include version):  
Windows 10

I use that version of OpenSSL :  
Win64 OpenSSL v1.1.1g  
[https://slproweb.com/products/Win32OpenSSL.html](https://slproweb.com/products/Win32OpenSSL.html)

Hello everybody,

I try to create a self signed certificate but I have this issue. Even if I add an EXT section in the OpenSSL.cnf, it’s not working. Don’t know what I can do.

If someone have the anwser, thanks a lot.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [April 22, 2020, 6:43am UTC](https://community.letsencrypt.org/t/error-ext-making-and-trusting-your-own-certificates/120333/2 "2020-04-22T06:43:17Z")

</div>

This has nothing to do with Let’s Encrypt.  
You might try using a search engine.  
“creating a self-signed cert with openssl”

If that doesn’t help…  
Try replacing:  
` -subj ‘/CN=localhost’ -extensions EXT`  
with:  
` -new -days 3650`  
[use any number of days that you desire and just walk through the prompts]

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [April 22, 2020, 6:45am UTC](https://community.letsencrypt.org/t/error-ext-making-and-trusting-your-own-certificates/120333/3 "2020-04-22T06:45:36Z")

</div>

Hi @JNB_Dimo

> [@JNB\_Dimo](#):
>
> \<(printf

that's a Unix command, I don't think that works on Windows.

> [@JNB\_Dimo](#):
>
> -extensions EXT

Looks like try and error. Check the documentation of your OpenSsl.

---

<div class="post-metadata">

**Author:** ![bruncsak](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruncsak/32/18414_2.png) [@bruncsak](https://community.letsencrypt.org/u/bruncsak)\
**Post date:** [April 22, 2020, 9:06am UTC](https://community.letsencrypt.org/t/error-ext-making-and-trusting-your-own-certificates/120333/4 "2020-04-22T09:06:38Z")

</div>

> [@JNB\_Dimo](#):
>
> I ran this command (2) :  
> openssl req -x509 -out localhost.crt -keyout localhost.key -newkey rsa:2048 -nodes -sha256 -subj '/CN=localhost' -extensions EXT
> 
> It produced this output (2):  
> Error Loading extension section EXT

Where did you find the keyword: `EXT` ?  
Normally I use `-reqexts SAN` but that may not apply to your case.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [April 22, 2020, 9:27am UTC](https://community.letsencrypt.org/t/error-ext-making-and-trusting-your-own-certificates/120333/5 "2020-04-22T09:27:35Z")

</div>

Amending the search to:  
`create a self-signed san cert using openssl in "windows"`  
I found this link:

> **[Generating self-signed certificates on Windows](https://medium.com/the-new-control-plane/generating-self-signed-certificates-on-windows-7812a600c2d8)**
>
> If you do anything with Identity, you’ll know you need certificates — lots of them — and that normally means self-signed to keep the costs…

  
Seems the SAN trick is to include the SAN entries in a SAN.cfg file.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [May 22, 2020, 9:27am UTC](https://community.letsencrypt.org/t/error-ext-making-and-trusting-your-own-certificates/120333/6 "2020-05-22T09:27:36Z")

</div>

Closed on May 22, 2020, 9:27am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.