<![CDATA[wolfSSL - Embedded SSL Library — Creation of cert with Subject Alternative Names]]> https://www.wolfssl.com/forums/topic1895-creation-of-cert-with-subject-alternative-names.html Thu, 21 Jul 2022 16:20:27 +0000 PunBB <![CDATA[Re: Creation of cert with Subject Alternative Names]]> https://www.wolfssl.com/forums/post6673.html#p6673 In the meantime, I will also try to create an example using with custom extensions.
Warm regards, Anthony

]]> Thu, 21 Jul 2022 16:20:27 +0000 https://www.wolfssl.com/forums/post6673.html#p6673 <![CDATA[Re: Creation of cert with Subject Alternative Names]]> https://www.wolfssl.com/forums/post6672.html#p6672 Hi stroebeljc,

how are you today? I'm glad to see you have discovered our `--enable-asn=template` flag! You say enabling it made other things break. I'm sorry to hear that.

Can you be more specific?  Can you let us know what broke?

Please send your details to support@wolfssl.com.  That will open up a support ticket and I will personally take ownership of it.

Warm regards, Anthony

]]> Thu, 21 Jul 2022 16:01:58 +0000 https://www.wolfssl.com/forums/post6672.html#p6672 <![CDATA[Re: Creation of cert with Subject Alternative Names]]> https://www.wolfssl.com/forums/post6671.html#p6671 Thanks David.
In reviewing your examples I do not see a direct way to set the Basic Constraints extension and to set the SAN to critical. Those are the two issues I still have remaining. I tried using the Custom Extensions example to set the Basic Constraints extension but it broke other things in my code because of --enable-asn=template.

]]> Thu, 21 Jul 2022 15:40:53 +0000 https://www.wolfssl.com/forums/post6671.html#p6671 <![CDATA[Re: Creation of cert with Subject Alternative Names]]> https://www.wolfssl.com/forums/post6667.html#p6667 Hi stroebeljc,

Thank you for sharing the example. The best examples are here:
https://github.com/wolfSSL/wolfssl-exam … er/certgen

I don't see an example for setting DirName, so I am having another engineer research this.

Thanks,
David Garske, wolfSSL

]]> Wed, 20 Jul 2022 22:20:13 +0000 https://www.wolfssl.com/forums/post6667.html#p6667 <![CDATA[Re: Creation of cert with Subject Alternative Names]]> https://www.wolfssl.com/forums/post6666.html#p6666 Any update on my questions?

]]> Wed, 20 Jul 2022 20:21:18 +0000 https://www.wolfssl.com/forums/post6666.html#p6666 <![CDATA[Re: Creation of cert with Subject Alternative Names]]> https://www.wolfssl.com/forums/post6661.html#p6661 DN means Distinguished Name.
Here is an example:

        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Alternative Name: critical
                DirName:/CN=10112233445566778899aabbccddeeff, DirName:/CN=20112233445566778899aabbccddeeff


I also need to set the Basic Constraint extension, but am not clear on how to do that. Can you provide guidance on this?

Finally, is there a way to set the Subject Alternative Name to critical?

]]> Mon, 18 Jul 2022 23:20:06 +0000 https://www.wolfssl.com/forums/post6661.html#p6661 <![CDATA[Re: Creation of cert with Subject Alternative Names]]> https://www.wolfssl.com/forums/post6660.html#p6660 Hi stroebeljc,

I am not sure what you mean about the DN inside a Directory Name. Can you provide an example of what you are trying to accomplish?

Thanks,
David Garske, wolfSSL

]]> Mon, 18 Jul 2022 22:31:27 +0000 https://www.wolfssl.com/forums/post6660.html#p6660 <![CDATA[Re: Creation of cert with Subject Alternative Names]]> https://www.wolfssl.com/forums/post6659.html#p6659 Thanks for the reference to the example.

Is there an easy way to create a Common Name field that's part of a Distinguished Name that I can then use to generate my SANs? As per the example, it's pretty easy to create the DNS names and IP addresses, but creating a DN inside a Directory Name seems a bit more complicated.

]]> Mon, 18 Jul 2022 20:44:28 +0000 https://www.wolfssl.com/forums/post6659.html#p6659 <![CDATA[Re: Creation of cert with Subject Alternative Names]]> https://www.wolfssl.com/forums/post6656.html#p6656 Hello stroebeljc,

Certainly! Here is an example from our repository:
https://github.com/wolfSSL/wolfssl-exam … mple.c#L67

Let us know if there are questions.

Thanks,
Eric @ wolfSSL Support

]]> Mon, 18 Jul 2022 16:24:57 +0000 https://www.wolfssl.com/forums/post6656.html#p6656 <![CDATA[Re: Creation of cert with Subject Alternative Names]]> https://www.wolfssl.com/forums/post6654.html#p6654 Hi Stoebeljc,

The only other option is setting the alternate names `.altNames` as raw DER. See the example here:
https://github.com/wolfSSL/wolfssl-exam … -alt-names
https://github.com/wolfSSL/wolfssl-exam … mple.c#L68

Thanks,
David Garske, wolfSSL

]]> Mon, 18 Jul 2022 15:23:37 +0000 https://www.wolfssl.com/forums/post6654.html#p6654 <![CDATA[Creation of cert with Subject Alternative Names]]> https://www.wolfssl.com/forums/post6653.html#p6653 Is there an example of how to create a certificate that has information in the SAN extension that does not require that the data come from another cert? I need to be able to generate the SAN data in real time and add to a cert.

Also, does wolfSSL support the Directory Names SAN extension?

]]> Mon, 18 Jul 2022 13:26:22 +0000 https://www.wolfssl.com/forums/post6653.html#p6653