NetWorker: "Subject Alternative Name" SAN을 사용하여 SSL용 CSR 생성

1. Linux 호스트에 파일을 생성합니다.

vi server_cert.cnf

2. 아래 내용을 server_cert.cnf 파일에 정의된 대로 사용하는 것이 중요합니다.

[req]
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no

[req_distinguished_name]
C   = 
ST  = 
L   = 
O   = 
OU  = 
CN  = 

[req_ext]
subjectAltName = @alt_names

[alt_names]
DNS.1 = 
DNS.2 = 
DNS.3 =
IP.1 =
IP.2 =
email.1 = 

3. 위의 템플릿이 생성되면 환경별 정보를 입력합니다. CSR 생성에 도움이 필요한 경우 도메인 관리자에게 문의하십시오. 

Country (C): The two-letter ISO code(* see link below)  for the country where the organization is located.

State/County/Region (ST): The state/region where the organization is located.

Locality (L): The city where the organization is located.

Organization Name (O): Usually the legal name of a company or entity and should include any suffixes such as Ltd., Inc., or Corp.
Organizational Unit (OU): Internal organization department/division name.

Common Name (CN): The fully or qualified domain name (FQDN) of the server based on the hostname available on the nsrla of the host.

Clarified SAN Guidance : It is important to include the FQDN as DNS.1. Add the short hostname and any other aliases or IP addresses as needed to cover all valid ways the host may be accessed. 

DNS.1: Mandatory. Always set to the full FQDN of the host (e.g., server.company.com).

DNS.2: Recommended. Short hostname (e.g., server).

DNS.3: Optional. Additional FQDN, short name, or IP address — use this for aliases, VIPs, or any other name that might resolve to the same server.

email.x: Optional. Include if required by your CA or if you want the cert to bind to an email identity.

IP.x: Optional. Use IP.x only when you want clients to connect directly to the IP and still trust the cert. If you don’t add IP.x and someone connects to https://192.168.1.10 → the SSL check will fail because the cer

* 조직이 위치한 국가 또는 지역의 두 글자 ISO 코드 입니다.

필요에 따라 DNS.x 및 IP.x 항목을 추가하거나 제거합니다.

예:

[req]
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no
[req_distinguished_name]
C   = US
ST  = Texas
L   = Round Rock
O   = Dell Technologies Inc.
OU  = Data Protection Team
CN  = server.fqdn.example.com    # Common Name - must match primary FQDN

# ================================
# Extensions for SAN
# ================================
[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
# DNS.1: Mandatory — fully qualified domain name (FQDN)
DNS.1 = server.fqdn.example.com

# DNS.2: Recommended — short hostname (without domain)
DNS.2 = servername

# DNS.3: Optional — additional FQDN, short name, or IP address
DNS.3 = server.alias.example.com

# Optional: include email if needed
#IP.1 = 192.1xx.1.10               # Literal IP address
#IP.2 = 10.1.1.5                   # Another IP if needed
#email.1 = admin@example.com

4. 아래 명령을 실행하여 파일에 추가된 정보를 기반으로 CSR 및 개인 키를 생성합니다. server_cert.cnf에 관한 자세한 내용을 참조하십시오.

#openssl req -new -newkey rsa:4096 -nodes -keyout new_server.key -out new_server.csr -config server_cert.cnf

5. CSR은 서명을 위해 인증 기관에 제출됩니다. 

NetWorker: cakey.pem을 교체한 후 NMC GST 서비스가 시작된 후 즉시 종료됨