Request SAN Certificate From Internal CA

[FN-GM]

Hi,

 

I have a CA Server Running Server 2012. Works good for issuing normal certificates.

 

I am trying to request a SAN certifcate for an internal IIS website. I have followed this guide under the section To use the Certificate Enrollment wizard with an enterprise CA.

 

I do not get the warning in step 13. But i pressed properties and added the other names as shown in the other steps.

 

When the certifate is issued it doesn't include the SANs.

 

What am i doing wrong please?

 

Thanks

[FN-GM]

Anyone please?

[FN-GM]

I have found this - https://www.icts.uiowa.edu/confluence/display/ICTSit/CSR+Generation+for+SAN+%28aka+UCC+or+Multiple+Domain%29+Certificates+within+Apache

 

I would like to make a certificate with an exportable key. The above link doesnt allow me to do so. But if i generate a usual one in IIS it does.

 

Any ideas please?

[Gatt]

I find it easier to use OpenSSL on a linux box for normal Web SSLs and modify the default conf file with the appropriate SANs.

I can then submit the CSR to the CA with no issues at all.

 

Other than that its a case of duplicating the Certificate template in Certificate Templates to allow additional info such as SANs

[FN-GM]

I used openssl on windows to generate a CSR. I have it a .cer file but i am struggling to use it as the key is not exportable

[Gatt]

When I use OpenSSL in linux, all I do is copy the CER file (as long as I donwload it in Base64 format) and pate it into a CRT file..

 

cat > server.domain.fqdn.crt

 

the CRT is then valid.

 

the full sequence is:

 

openssl genrsa -des3 -out keyfile.key 2048

openssl req -new -key keyfile.key -out server.domain.fqdn.csr

cat server.domain.fqdn.csr

 

open http://cert-ca-server/certsrv

Follow the options to create a new certificate (request -> advanced) + paste the CSR text into the box and choose a WebServer template that is SAN capable

Download the CER in Base64 format

open in notepad++ and copy the text

in linux type:

cat > server.domain.fqdn.crt

 

Voila! one CRT file!

[Gatt]

Also, have you modified the CA template to allow keys to be exportable?

[FN-GM]

Yep it allows be to export a key if i generate the CSR in Windows or IIS.

 

Basically i want to make a SAN. Doing what it says in this link, is this the correct thing? - https://www.icts.uiowa.edu/confluence/display/ICTSit/CSR+Generation+for+SAN+%28aka+UCC+or+Multiple+Domain%29+Certificates+within+Apache

 

I have followed the above made a .csr but it into my CA now i have a .cer and a .key. Will this command turn them into a .pfx? - openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx -certfile CACert.cer

 

Thanks

Edited April 23, 2013 by FN-GM

[Gatt]

It should have downloaded as a .CER - unless you chose download the full chain as well (2nd Option on the download page for the CA)?

 

As for cpnverting PFX - try this site: MarkBrilman.nl » Howto convert a PFX to a seperate .key/.crt file

(not had to do it myself..)