NetWorker: CSR Generation for SSL with "Subject Alternative Name" SAN

Summary: This article provides general instructions on how to generate a Certificate Signing Request (CSR) for SSL which included Subject Alternative Names (SAN). This knowledgebase is intended to provide additional support, however the system administrator must complete this task. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Instructions

Note: This process uses the OpenSSL utility. By default, Windows hosts do not include the OpenSSL program. If it is not possible to install OpenSSL on the Windows NetWorker server, the CSR can be performed on any Linux host. On Linux, the OpenSSL is available by default. Preserve the generated .csr and .key files for validation during SSL integration on the NetWorker Server.

Request for generating CSR with primary Common Name (CN) and Subject Alternative Names (Indicate all the domain names and IP addresses). 
  1. Create a file on any Linux host.
vi server_cert.cnf
  1. Paste the below contents to the server_cert.cnf file.
[req]
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no

[req_distinguished_name]
C   = 
ST  = 
L   = 
O   = 
OU  = 
CN  = 

[req_ext]
subjectAltName = @alt_names

[alt_names]
DNS.1 = 
DNS.2 = 
DNS.3 =
IP.1 =
IP.2 =
email.1 =
  1. Once the above template has been created, enter the environment-specific information. Engage with your domain administrator if assistance is required with generating the CSR. 
Country (C): The two-letter ISO code(* see link below)  for the country where the organization is located.

State/County/Region (ST): The state/region where the organization is located.

Locality (L): The city where the organization is located.

Organization Name (O): Usually the legal name of a company or entity and should include any suffixes such as Ltd., Inc., or Corp.
Organizational Unit (OU): Internal organization department/division name.

Common Name (CN): The fully or qualified domain name (FQDN) of the server based on the hostname available on the nsrla of the host.

Clarified SAN Guidance : It is important to include the FQDN as DNS.1. Add the short hostname and any other aliases or IP addresses as needed to cover all valid ways the host may be accessed. 

DNS.1: Mandatory. Always set to the full FQDN of the host (e.g., server.company.com).

DNS.2: Recommended. Short hostname (e.g., server).

DNS.3: Optional. Additional FQDN, short name, or IP address — use this for aliases, VIPs, or any other name that might resolve to the same server.

email.x: Optional. Include if required by your CA or if you want the cert to bind to an email identity.

IP.x: Optional. Use IP.x only when you want clients to connect directly to the IP and still trust the cert. If you don’t add IP.x and someone connects to https://192.168.1.10 → the SSL check will fail because the cer
* The two-letter ISO code This hyperlink is taking you to a website outside of Dell Technologies. for the country or region where the organization is located.
 

Add or remove DNS.x and IP.x entries as needed.

Example:

[req]
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no
[req_distinguished_name]
C   = US
ST  = Texas
L   = Round Rock
O   = Dell Technologies Inc.
OU  = Data Protection Team
CN  = server.fqdn.example.com    # Common Name - must match primary FQDN

# ================================
# Extensions for SAN
# ================================
[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
# DNS.1: Mandatory — fully qualified domain name (FQDN)
DNS.1 = server.fqdn.example.com

# DNS.2: Recommended — short hostname (without domain)
DNS.2 = servername

# DNS.3: Optional — additional FQDN, short name, or IP address
DNS.3 = server.alias.example.com

# Optional: include email if needed
#IP.1 = 192.1xx.1.10               # Literal IP address
#IP.2 = 10.1.1.5                   # Another IP if needed
#email.1 = admin@example.com
  1. Run the below command to generate the CSR and Private Key based on the information added on the file server_cert.cnf.
#openssl req -new -newkey rsa:4096 -nodes -keyout new_server.key -out new_server.csr -config server_cert.cnf
  1. The CSR is submitted to a Certificate Authority for signing. 

Additional Information

Note: Linux hosts using NetWorker 19.12.0.0 support OpenSSL 3.0.14. Windows still requires 1.1.1n.


NetWorker: NMC GST service starts then immediately shuts down after replacing cakey.pem

Affected Products

NetWorker, NetWorker Management Console
Article Properties
Article Number: 000251184
Article Type: How To
Last Modified: 16 Jul 2025
Version:  4
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.