My ACME client appears to be functional now, i can get certificates however the certificates my client is getting are only valid for the CommonName and it seems that the SubjectAltName from the CSR is being ignored.
My guess is that the format i am using for specifying the SAN must not be valid; or maybe the feature is currently not working on the server side?
I keep checking my CSR online with each different format tried and it seems to be valid; however the certificates i get back seem to ignore any SAN other than the CommonName.
In one of my tests i omitted the SAN in the CSR entirely, and the online CSR checker verified that the SAN was not there, however the certificate i got back from the LE staging server still included a SAN with the same value as the CommonName even though the CSR did not include it…
Can anyone give me some guidance on the correct format to specify multiple domain names within the SubjectAltName property of the CSR?
Below are some of the formats i have tried:
SAN = DNS:www1.us.example.com,DNS:www2.fr.example.com,DNS:www3.jp.example.com
SAN = DNS:www1.us.example.com, DNS:www2.fr.example.com, DNS:www3.jp.example.com
SAN = {DNS:www1.us.example.com,DNS:www2.fr.example.com,DNS:www3.jp.example.com}
SAN = {DNS.1=www1.us.example.com,DNS.2=www2.fr.example.com,DNS.3=www3.jp.example.com}
SAN = {www1.us.example.com,www2.fr.example.com,www3.jp.example.com}
Do you expect anyone to be able to help without any specifics about how you’re generating the CSRs? Those lines don’t tell anything about that.
BTW, LE constructing a single SAN with your common name, even when you didn’t specify a SAN, is perfectly normal. It can construct a cert any way it wants and it can pick any data it’s willing to verify. You will find that it will strip any organisation you put in the CSR, too, for example.
I hypothesize that @tpenner is somehow trying to put these into the DN field as textual data (which wouldn’t survive into the actual CSR because there is no DN element called “SAN”) rather than using the X.509v3 subjectAltName extension. Just a random guess. I agree that we need to know how he is generating the CSR.
Alternatively, it would be helpful to see the openssl x509 -in example.pem -text -noout parsing of the CSR in question.
The code i provided above could be considered Psuedo Code.
The actual command i am using to build the CSR is here, it takes two arrays of data for the CSR, properties and values. The properties array uses the code value for the CSR element, and the value is text.
For the SAN code element i am specifying 85 which is the Numerical ID that OpenSSL defines for SubjectAltName.
For the SAN value element i have tried specifying all of the formats i listed above.
I will check the output of the CSR in question now using OpenSSL, prior to now i had been using online tools for checking the CSR.
