Is this the right way to generate a wildcard CSR?
Clash Royale CLAN TAG#URR8PPP
up vote
1
down vote
favorite
I generated my CSR on an Amazon Linux system using this command
openssl req -new -sha256 -key ~/mymaindomain.com.ssl/mymaindomain.com.key -out ~/mymaindomain.com.ssl/mymaindomain.com.csr
I verified what I had done using
[davea@host mymaindomain.com.ssl]$ openssl req -noout -text -in ~/mymaindomain.com.ssl/mymaindomain.com.csr
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=US, ST=NY, L=New York, O=Main Co, OU=SubCo, CN=mymaindomain.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Before I submit this to a CA, I was curious if this will match "www.mymaindomain.com" and "abc.mymaindomain.com." I wanted to create a CSR that would match the "*.mymaindomain.com" expression but not quite sure if I did it right.
linux openssl ssl https amazon-linux
asked Mar 22 at 19:33
Dave
368827
add a comment |Â
up vote
1
down vote
favorite
I generated my CSR on an Amazon Linux system using this command
openssl req -new -sha256 -key ~/mymaindomain.com.ssl/mymaindomain.com.key -out ~/mymaindomain.com.ssl/mymaindomain.com.csr
I verified what I had done using
[davea@host mymaindomain.com.ssl]$ openssl req -noout -text -in ~/mymaindomain.com.ssl/mymaindomain.com.csr
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=US, ST=NY, L=New York, O=Main Co, OU=SubCo, CN=mymaindomain.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Before I submit this to a CA, I was curious if this will match "www.mymaindomain.com" and "abc.mymaindomain.com." I wanted to create a CSR that would match the "*.mymaindomain.com" expression but not quite sure if I did it right.
linux openssl ssl https amazon-linux
asked Mar 22 at 19:33
Dave
368827
When it asked you for the common name, did you list it as *.mydomain.com or just .mydomain.com? If you have the wildcard listed as the common name, it should work. Doesn't look like your common name has a wildcard.
– saleetzo
Mar 22 at 19:41
You didn't make it correctly, since there's no wildcard (*) appearing. Look with this example:openssl s_client -connect stackexchange.com:443look at the CN . CN=*.stackexchange.com there's a*for wildcard. It wouldn't match stackexchange.com , but if you get the certificate and decode it withopenssl x509 -noout -textyou'll see all the SANs:DNS:*.stackexchange.com, DNS:stackoverflow.com, DNS:*.stackoverflow.com,[...]DNS:stackexchange.com. Now you know what to do. And yes adding SANs with openssl is a bit painful, but I'm sure there are already Q/A about this
– A.B
Mar 22 at 19:53
Thanks. No I didn't make it with "*.mymaindomain.com" ... it was just "mymaindomain.com". These comments give me exactly the answer I was looking for.
– Dave
Mar 22 at 20:13
add a comment |Â
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I generated my CSR on an Amazon Linux system using this command
openssl req -new -sha256 -key ~/mymaindomain.com.ssl/mymaindomain.com.key -out ~/mymaindomain.com.ssl/mymaindomain.com.csr
I verified what I had done using
[davea@host mymaindomain.com.ssl]$ openssl req -noout -text -in ~/mymaindomain.com.ssl/mymaindomain.com.csr
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=US, ST=NY, L=New York, O=Main Co, OU=SubCo, CN=mymaindomain.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Before I submit this to a CA, I was curious if this will match "www.mymaindomain.com" and "abc.mymaindomain.com." I wanted to create a CSR that would match the "*.mymaindomain.com" expression but not quite sure if I did it right.
linux openssl ssl https amazon-linux
asked Mar 22 at 19:33
Dave
368827
I generated my CSR on an Amazon Linux system using this command
openssl req -new -sha256 -key ~/mymaindomain.com.ssl/mymaindomain.com.key -out ~/mymaindomain.com.ssl/mymaindomain.com.csr
I verified what I had done using
[davea@host mymaindomain.com.ssl]$ openssl req -noout -text -in ~/mymaindomain.com.ssl/mymaindomain.com.csr
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=US, ST=NY, L=New York, O=Main Co, OU=SubCo, CN=mymaindomain.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Before I submit this to a CA, I was curious if this will match "www.mymaindomain.com" and "abc.mymaindomain.com." I wanted to create a CSR that would match the "*.mymaindomain.com" expression but not quite sure if I did it right.
linux openssl ssl https amazon-linux
asked Mar 22 at 19:33
Dave
368827
asked Mar 22 at 19:33
Dave
368827
asked Mar 22 at 19:33
Dave
368827
asked Mar 22 at 19:33
Dave
368827
368827
When it asked you for the common name, did you list it as *.mydomain.com or just .mydomain.com? If you have the wildcard listed as the common name, it should work. Doesn't look like your common name has a wildcard.
– saleetzo
Mar 22 at 19:41
You didn't make it correctly, since there's no wildcard (*) appearing. Look with this example:openssl s_client -connect stackexchange.com:443look at the CN . CN=*.stackexchange.com there's a*for wildcard. It wouldn't match stackexchange.com , but if you get the certificate and decode it withopenssl x509 -noout -textyou'll see all the SANs:DNS:*.stackexchange.com, DNS:stackoverflow.com, DNS:*.stackoverflow.com,[...]DNS:stackexchange.com. Now you know what to do. And yes adding SANs with openssl is a bit painful, but I'm sure there are already Q/A about this
– A.B
Mar 22 at 19:53
Thanks. No I didn't make it with "*.mymaindomain.com" ... it was just "mymaindomain.com". These comments give me exactly the answer I was looking for.
– Dave
Mar 22 at 20:13
add a comment |Â
When it asked you for the common name, did you list it as *.mydomain.com or just .mydomain.com? If you have the wildcard listed as the common name, it should work. Doesn't look like your common name has a wildcard.
– saleetzo
Mar 22 at 19:41
You didn't make it correctly, since there's no wildcard (*) appearing. Look with this example:openssl s_client -connect stackexchange.com:443look at the CN . CN=*.stackexchange.com there's a*for wildcard. It wouldn't match stackexchange.com , but if you get the certificate and decode it withopenssl x509 -noout -textyou'll see all the SANs:DNS:*.stackexchange.com, DNS:stackoverflow.com, DNS:*.stackoverflow.com,[...]DNS:stackexchange.com. Now you know what to do. And yes adding SANs with openssl is a bit painful, but I'm sure there are already Q/A about this
– A.B
Mar 22 at 19:53
Thanks. No I didn't make it with "*.mymaindomain.com" ... it was just "mymaindomain.com". These comments give me exactly the answer I was looking for.
– Dave
Mar 22 at 20:13
When it asked you for the common name, did you list it as *.mydomain.com or just .mydomain.com? If you have the wildcard listed as the common name, it should work. Doesn't look like your common name has a wildcard.
– saleetzo
Mar 22 at 19:41
When it asked you for the common name, did you list it as *.mydomain.com or just .mydomain.com? If you have the wildcard listed as the common name, it should work. Doesn't look like your common name has a wildcard.
– saleetzo
Mar 22 at 19:41
You didn't make it correctly, since there's no wildcard (
* ) appearing. Look with this example: openssl s_client -connect stackexchange.com:443 look at the CN . CN=*.stackexchange.com there's a * for wildcard. It wouldn't match stackexchange.com , but if you get the certificate and decode it with openssl x509 -noout -text you'll see all the SANs: DNS:*.stackexchange.com, DNS:stackoverflow.com, DNS:*.stackoverflow.com, [...] DNS:stackexchange.com . Now you know what to do. And yes adding SANs with openssl is a bit painful, but I'm sure there are already Q/A about this– A.B
Mar 22 at 19:53
You didn't make it correctly, since there's no wildcard (
* ) appearing. Look with this example: openssl s_client -connect stackexchange.com:443 look at the CN . CN=*.stackexchange.com there's a * for wildcard. It wouldn't match stackexchange.com , but if you get the certificate and decode it with openssl x509 -noout -text you'll see all the SANs: DNS:*.stackexchange.com, DNS:stackoverflow.com, DNS:*.stackoverflow.com, [...] DNS:stackexchange.com . Now you know what to do. And yes adding SANs with openssl is a bit painful, but I'm sure there are already Q/A about this– A.B
Mar 22 at 19:53
Thanks. No I didn't make it with "*.mymaindomain.com" ... it was just "mymaindomain.com". These comments give me exactly the answer I was looking for.
– Dave
Mar 22 at 20:13
Thanks. No I didn't make it with "*.mymaindomain.com" ... it was just "mymaindomain.com". These comments give me exactly the answer I was looking for.
– Dave
Mar 22 at 20:13
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Â
draft saved
draft discarded
Â
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f432914%2fis-this-the-right-way-to-generate-a-wildcard-csr%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
When it asked you for the common name, did you list it as *.mydomain.com or just .mydomain.com? If you have the wildcard listed as the common name, it should work. Doesn't look like your common name has a wildcard.
– saleetzo
Mar 22 at 19:41
You didn't make it correctly, since there's no wildcard (
*) appearing. Look with this example:openssl s_client -connect stackexchange.com:443look at the CN . CN=*.stackexchange.com there's a*for wildcard. It wouldn't match stackexchange.com , but if you get the certificate and decode it withopenssl x509 -noout -textyou'll see all the SANs:DNS:*.stackexchange.com, DNS:stackoverflow.com, DNS:*.stackoverflow.com,[...]DNS:stackexchange.com. Now you know what to do. And yes adding SANs with openssl is a bit painful, but I'm sure there are already Q/A about this– A.B
Mar 22 at 19:53
Thanks. No I didn't make it with "*.mymaindomain.com" ... it was just "mymaindomain.com". These comments give me exactly the answer I was looking for.
– Dave
Mar 22 at 20:13