ECS 3.5.0.1 Administration Guide

Generate a SAN configuration

If you want your certificates to support Subject Alternative Names (SANs), you must define the alternative names in a configuration file.

1. Create the configuration file.

   cp /usr/lib/ssl/openssl.cnf request.conf

2. Edit the configuration file with a text editor and make the following changes.
   1. Add the [ alternate_names ] .
      For example:

      [ alternate_names ]
      DNS.1 = os.example.com
      DNS.2 = atmos.example.com
      DNS.3 = swift.example.com

      NOTE There is a space between the bracket and the name of the section.
      If you are uploading the certificates to ECS nodes rather than to a load balancer, the format is:

      [ alternate_names ]
      IP.1 = <IP node 1>
      IP.2 = <IP node 2>
      IP.3 = <IP node 3>
      ...
      

   2. In the section [ v3_ca ], add the following lines:

      subjectAltName    = @alternate_names
      basicConstraints = CA:FALSE
      keyUsage = nonRepudiation, digitalSignature, keyEncipherment
      extendedKeyUsage = serverAuth

      The following line is likely to already exist in this [ v3_ca ] section. If you create a certificate signing request, you must comment it out as shown:

      #authorityKeyIdentifier=keyid:always,issuer

   3. In the [ req ] section, add the following lines:

      x509_extensions = v3_ca   #for self signed cert
      req_extensions = v3_ca    #for cert signing req

   4. In the section [ CA_default ], uncomment or add the line:

      copy_extension=copy