Adding extension to a self-signed x509 certificate and signing a CSR with extensions (basic constraint CA:True/False, key usage, extended key usage, SAN etc.)

Adding extension to a self-signed x509 certificate and signing a CSR with extensions (basic constraint CA:True/False, key usage, extended key usage, SAN etc.)

Generating self-signed x509 certificate with extensions(basic constraint, key usage, extended key usage, SAN):

 

> openssl req -x509 -nodes -newkey rsa:2048 -keyout key.pem -out certificate.pem -days 1000  -addext "keyUsage = digitalSignature, keyEncipherment, keyCertSign" -addext "extendedKeyUsage = serverAuth" -addext basicConstraints=critical,CA:FALSE -addext "subjectAltName = DNS:tgclean.cisco.com, IP:10.106.72.231"

Generating CSR with extensions (basic constraint, key usage, extended key usage, SAN):

 

>openssl.exe req -x509 -out signing.csr -new -newkey rsa:2048 -nodes -keyout signing.key -addext "keyUsage = digitalSignature, keyEncipherment, keyCertSign"  -addext "extendedKeyUsage = serverAuth" -addext basicConstraints=critical,CA:FALSE -addext "subjectAltName = DNS:tgclean.cisco.com, IP:10.106.72.231"

Sign a CSR using the internal CA and key with the extensions:

openssl.exe x509 -req -days 365 -in signing.csr -CA CA.crt -CAkey CA.key -set_serial 53 -out  signed.crt -extensions v3_req -extfile openssl.cnf

Content of the openssl.cnf:

### cat openssl.cnf
--------------------
[req]
req_extensions = v3_req
[v3_req]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:tgsigned.clean.cisco.com, IP:10.106.72.230
--------------------

View the certificate in Openssl:

>openssl.exe x509 -in signed.crt -text