3 ms·
This can be a one-liner in openssl: openssl req -new -sha256 -x509 -days 365 -newkey RSA:4096 -nodes -keyout domain.key -subj "/CN=example.com" -reqexts SA
by diafygi 11y ago
This can be a one-liner in openssl:
openssl req -new -sha256 -x509 -days 365 -newkey RSA:4096 -nodes -keyout domain.key -subj "/CN=example.com" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:www.example.com,DNS:mail.example.com")) -out domain.crt
For a CSR, the same technique can be used:
openssl req -new -sha256 -newkey RSA:4096 -nodes -keyout domain.key -subj "/CN=example.com" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:www.example.com,DNS:mail.example.com")) -out domain.csr
- tiyema 11y agoIt works too thanks. We should also notify the differences : I have compared both and have noticed your oneliner generates a CA certificate (which may not be what we want). Also the oneliner rely on the /etc/ssl/openssl.conf file which can change over the time, so the generated certificate may be affected too
- tiyema 11y agoAlso, looking at the gencert.sh file (https://github.com/frntn/x509-san/blob/686f0468/gencert.sh https://github.com/frntn/x509-san/blob/686f0468/gencert.sh) we can see it also uses a oneliner with process substitution. (may be unrelevant but that kind of nice too)