Create self signed certificates with Subject Alternative Names

This video explains how to create a self signed certificate with Subject Alternative Names (SAN).

A certificate with Subject Alternative Names is a single certificate supporting multiple Common Names (CN), for example:

This means this single certificate can be used in multiple URLs:

Chrome browsers will issue a warning if your SSL certificate does not specify Subject Alternative Names.

This video assumes that you have installed OpenSSL.

To check if your system has OpenSSL installed, type: openssl version -a

The procedure to create self signed certificates with Subject Alternative names is also documented at:

Warning: Never use self signed certificates in production environments.
It is okay to use it in development or testing environments.

1. Create a 2048 bit Certificate Authority (CA) private key:

2. Create a self signed CA certificate:

3. Create a 2048 bit Certificate Authority (CA) certificate:
Country Name (2 letter code) [AU]:NL
State or Province Name (full name) [Some-State]:Noord-Holland
Locality Name (eg, city) []:Zaandam

Download and modify the server configuration file according to your situation.

[dn]
C=NL
ST=Zaandam
L=Noord-Holland
O=End Point
OU=Research and development

5. Create a server Certificate Signing Request (CSR) and server private key.

Modify the server extension file according to your situation.

Add Subject Alternative Names:
[alt_names]

This common name must be mentioned as one of the Subject Alternative Names.

7. Create the server certificate:

Each issued certificate must contain a unique serial number assigned by the CA.
It must be unique for each certificate given by a given CA.
OpenSSL keeps the used serial numbers on a file.

Always keep the private keys secure:

Recap
We have created our own Certificate Authority (root certificate).
But this CA is not trusted by our system.
Next our CA has created a certificate with SAN.
Trusted CA’s such as Comodo and GoDaddy are trusted because their root certificates are already imported in our system.

In YouTube video “Geth supporting SSL using reverse proxy server” I will be using this self signed certificate to setup a reverse proxy server accessible by:

Check out all my other Ethereum related tutorial videos:

Subscribe to my YouTube channel:

The presentation used in this video tutorial can be found at:

#mobilefish #howto #ethereum

[lubrifiax]

Thanks man, you managed to simply explain me in 5 min what 99% of the topics on the net can't in 3 months!

[waheed]

WOW, You are brilliant, taught a difficult subject in a very easy manner. Really liked it... Thank you SIR!

[redhatfan]

Excellent Instructional video. Thank you for taking the time to explain in detail how this works.

[jonathanmartins]

I spend 4 hours trying to make this work.
Your video help me do it! Thank you very much!

[liberatemi]

Great tutorial - very comprehensive, also provides a good insight as to how OpenSSL features are organised around enterprise concerns.
Thanks!

[Neomeister]

My man! I didn't follow your instructions to the letter as I had already completed most of these steps but adding the "subjectAltName = @alt_names" pointer to the server extension is what I was missing. Thank you.

[rohitshetty]

Simple and effective tutorial...Thanks!!!

[boring]

You should be importing the CA certificate into your trusted store. Then every certificate signed by that CA will be trusted by your computer. (Your file ca.pem)

[cbnitez]

Works for me! Just one cuestion, if I want to put the server.crt and server.key in one file, for example server_bundle.pem. Is going to work?

[warronfrench]

I cannot visually read your webpage from the video. It is very blurry.

[davidharrison]

May I ask a question. In my development environment I have multiple http servers, openvpn servers, vcenter and esx servers etc, and I remove or change of add new ones regularly.

They are all in the same domain eg. *.domain.com.

I can;t see how adding all the names into the subjectalternatenames field would be practical as they change, would having only "domain.com" in the subjectalternatename be sufficient to cover all the hosts?

[shwetamanjrekar]

can anyone tell me, why the main URL or subject URL is needed to be mentioned in the DNS list?

[Guiltypleasure_]

Am getting an error like below while issuing User Certificate using openSSL
Like: Windows
I am unable to access to the C:\ssl\democa Invalid argument

[gabrielbong]

Hi Sir
I have queries to seek your advice after following all the steps very closely on a Windows 10 environment:

Q1.) When I enter this command: sudo openssl x509 -req -in server.csr -CA ca.pem -CAkey privkey.pem -CAcreateserial -out server.crt -days 3650 -extfile server_v3.ext

I don’t have the generated ca.srl file

Please kindly advise on this if I missed out any step

[Junaidddevil]

Hi, I need to generate a client certificate also, can you please advise how this can be incorporated ?

[donnagamis]

Hi you mentioned to install server.key and the certificate can you explain how to install the server.key? Thanks.