Add Subject Alternative Names to existing Certificate

ucs-4
ssl
certificates
san

#1

In some situations you might want to add additional SAN’s (subject alternative names) to your host certificate. This is pretty handy when you’re using one or several aliases for one of your hosts.

First of all create a backup of the following files:

  • openssl.cnf
  • req.pem
root@ucs:# cd /etc/univention/ssl/<FQDN>
root@ucs:/etc/univention/ssl/<FQDN># cp openssl.cnf{,.orig}; cp req.pem{,.orig}

Now edit the certificate settings in openssl.cnf for the appropriate host certificate by changing line 101 - section [ v3_req ]

[ v3_req ]

subjectAltName = DNS:, DNS:

into

subjectAltName = @alt_names

and add the following line underneath:

[alt_names]
DNS.1 = <FQDN>
DNS.2 = <HOSTNAME>
DNS.3 = <ALT_FQDN>
DNS.4 = <ALT_HOSTNAME>

You might add here quite more entries; according to rfc5280 the upper bound is unspecified.

Now it’s time to create a new request (csr) with the existing private.key.

root@ucs:/etc/univention/ssl/<FQDN># . /usr/share/univention-ssl/make-certificates.sh
root@ucs:/etc/univention/ssl/<FQDN># openssl req -new -key private.key -config openssl.cnf -out req.pem

Now check if all SAN’s are existing in the newly created request.

root@ucs:/etc/univention/ssl/<FQDN># openssl req -in req.pem -noout -text | grep -E "(Subject Alternative Name|DNS)"

With this request you can create the renewed certificate.
From here all steps are done with UCS internal tools so you might continue via UMC.

root@ucs:~# univention-certificate renew -name <FQDN> -days 1825

Finally you also should check the certificate.

root@ucs:/etc/univention/ssl/<FQDN># openssl x509 -in cert.pem -noout -text | less

Of course the last step is to publish the renewed certificate as described in section “Copy the new certificate” from article:
https://help.univention.com/t/renewing-the-ssl-certificates/37