Generating a new CSR

Help
3

Hey Joseph :slightly_smiling_face:

To generate a SAN CSR with OpenSSL, the configuration file needs to be formatted a specific way. Here is the section of CertSage that generates the CSR:

// *** GENERATE CSR ***

$dn = [
  "commonName" => $domainNames[0]
];

$options = [
  "digest_alg" => "sha256",
  "config" => $this->dataDirectory . "/openssl.cnf"
];

$opensslcnf =
  "[req]\n" .
  "distinguished_name = req_distinguished_name\n" .
  "req_extensions = v3_req\n\n" .
  "[req_distinguished_name]\n\n" .
  "[v3_req]\n" .
  "subjectAltName = @san\n\n" .
  "[san]\n";

$i = 0;
foreach ($domainNames as $domainName)
{
  ++$i;
  $opensslcnf .= "DNS.$i = $domainName\n";
}

try
{
  $this->writeFile($this->dataDirectory . "/openssl.cnf",
                   $opensslcnf,
                   0600);

  $csrObject = openssl_csr_new($dn, $certificateKey, $options);

  if ($csrObject === false)
    throw new Exception("generate csr failed");
}
finally
{
  $this->deleteFile($this->dataDirectory . "/openssl.cnf");
}

if (!openssl_csr_export($csrObject, $csr))
  throw new Exception("export csr failed");

As you can see, the domain names are listed one per line in the format DNS.# = domain.

3 Likes