Part of running a lot of self-hosted test servers for developers is setting up SSL to verify things like API calls work the way you expect. With recent changes in web browsers, specifically Chrome, rejecting certificates that don’t have Subject Alternative Names. I had to document how to create self-signed certs with the proper SAN fields. I generally create the certificates on my Mac and scp them to the local webserver. In this example, I was creating certs for a self-hosted gitlab server.
Instructions
To create a self-signed SAN certificate with multiple subject alternate names, complete the following procedure:
Create an OpenSSL configuration file on the local computer, edit the fields in [req_distinguished_name] and [alt_names] to make them relevant to you.
Example: gitlab-ce.conf
[req] default_bits = 2048 distinguished_name = req_distinguished_name x509_extensions = v3_req prompt = no [req_distinguished_name] C = US ST = AZ L = Scottsdale O = companyname OU = companydepartment CN = gitlab-ce [v3_req] keyUsage = nonRepudiation, digitalSignature, keyEncipherment extendedKeyUsage = serverAuth subjectAltName = @alt_names [alt_names] DNS.1 = gitlab-ce DNS.2 = gitlab-ce.example.local
Create the certificate. I prefer to cd into the directory with my .conf file before running the command
openssl req -x509 -nodes -days 3500 -newkey rsa:2048 \ -keyout gitlab-ce.example.local.key \ -out gitlab-ce.example.local.crt \ -config gitlab-ce.conf \ -extensions 'v3_req'
# Command Usage ------------------------------------------------ req The command creates and processes certificate requests -x509: Create a self-signed certificate -nodes: Create a certificate that does not require a passphrase -days: the length of time in days for the certificate -newkey rsa:2048: Create a RSA key for use with the certificate -keyout private key out path -out public key out path -config Specify an alternative configuration file -extensions alternative sections to include
Run the following command to verify the certificate
openssl x509 -in gitlab-ce.example.local.crt -noout -text
Check the output for X509v3 Subject Alternative Name:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 11345571246859837741 (0x9d7390f006f7612d)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, ST=AZ, L=Scottsdale, O=companyname, OU=companydepartment, CN=gitlab-ce
Validity
Not Before: Mar 3 15:35:36 2020 GMT
Not After : Oct 2 15:35:36 2029 GMT
Subject: C=US, ST=AZ, L=Scottsdale, O=companyname, OU=companydepartment, CN=gitlab-ce
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:c8:92:af:95:80:bd:9b:8f:0d:3e:2f:71:a9:14:
94:53:cd:cb:ea:ed:fa:ba:e5:2d:b1:61:ef:cf:86:
12:69:01:89:82:d7:e6:84:6f:69:16:d8:6f:7a:86:
2b:e7:34:78:02:f5:07:34:6b:19:1e:d7:82:c6:c2:
a8:1f:da:e0:2b:fa:59:6a:54:97:94:eb:5c:f7:47:
00:5c:68:a2:1d:85:56:d8:36:79:f7:d3:e1:65:51:
83:5e:12:9e:d6:65:b7:df:08:a5:b0:6a:45:07:19:
30:b8:c0:ab:13:6c:a0:99:92:17:78:97:5c:23:25:
0e:b5:07:1b:78:31:a3:59:36:72:0c:dd:42:d4:b3:
28:79:12:c7:92:37:bd:3f:6c:15:54:7f:4c:4d:a0:
03:6e:45:85:ed:c1:20:41:af:13:4e:40:5e:c1:3d:
1f:44:39:5d:fc:56:5c:79:10:22:31:d0:71:5e:1c:
41:6e:86:ca:58:60:65:30:f8:d5:da:87:fc:93:20:
0c:e5:c8:90:58:eb:62:0d:3a:ba:5e:4f:42:d7:e8:
5d:df:66:c3:3a:f9:a4:db:0b:86:25:f1:9e:de:1d:
72:c1:7a:04:c6:55:42:31:9f:f8:74:ff:13:31:79:
ba:52:63:a1:01:d4:1f:fd:38:ce:0a:0c:23:28:11:
04:e3
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Subject Alternative Name:
DNS:gitlab-ce, DNS:gitlab-ce.example.local
Signature Algorithm: sha256WithRSAEncryption
3c:c6:17:da:d3:9d:f8:7d:38:ea:cd:b2:b1:92:6f:3e:82:46:
e4:77:aa:02:6a:7e:a2:5e:f2:9a:42:4c:ae:c7:86:41:a4:9a:
73:65:e5:c0:ae:5b:36:f9:4a:c8:62:0b:ad:3b:ae:10:e4:60:
02:20:a4:4f:35:ec:5e:35:7e:23:da:aa:96:5c:71:63:b0:d7:
da:c6:46:1d:dc:00:9b:f1:97:bb:a1:1e:54:aa:1c:76:13:7f:
3b:28:5a:ef:94:4e:c4:37:ca:bd:3e:6e:2e:13:8b:cb:f2:f7:
5b:13:53:bf:e6:82:4c:48:38:95:bb:c5:3b:4c:54:13:6f:9b:
fd:f6:4e:e2:a8:c2:7e:46:2b:0f:de:aa:0d:21:af:db:3f:84:
5e:94:24:4b:ea:ed:99:f6:29:e1:1d:00:b3:75:61:fa:8b:8c:
bf:29:6e:35:e5:e0:6e:b6:4f:44:de:f5:12:0a:19:d7:2a:8d:
02:29:10:b6:79:9d:77:6c:7e:d3:1d:1a:4d:a0:0a:3b:06:54:
4c:cb:62:e2:15:dc:1b:7a:9a:ef:c7:8d:47:74:ec:2d:c9:b4:
30:4d:9f:13:52:b5:a8:66:ce:59:63:f7:93:ee:6c:1b:d9:e3:
50:a6:35:3a:59:29:05:80:c8:e9:24:a0:75:b3:32:4c:ef:60:
50:0e:d7:50
Now you can copy your certs to whatever webserver you’re running.
