Hi Kaleb,
I am currently using WolfSSl to generate self-signed certificates for the offline web servers. In the SAN case, I am working on putting the IP address of the web server into the SAN field.
Here are part of the code (including the code you gave me) to generate the certificate, the code was working perfectly fine without the SAN part (even generated certificate with your new code still makes the certificate invalid):
Cert myCert;
unsigned char *keyPem;
int keyPemLen = 0;
unsigned char *keyDer;
int keyDerLen = 0;
int certPemLen = 0;
int ret = -1;
word32 idx = 0;
int certSz = 0;
unsigned char *certDer;
int certDerSz;
unsigned char *certPem;
ecc_key privKey, pubKey;
RNG rng;
FILE *f;
wc_InitRng(&rng);
keyPem = malloc(4096);
keyDer = malloc(4096);
certDer = malloc(4096);
certPem = malloc(4096);
wc_InitCert(&myCert);
char myAltNames[] = {
// SEQUENCE (2 elements)
0x30, 0x14,
// OBJECT IDENTIFIEER: 2.5.29.17 subjectAltName
// (X.509 extension)
0x06, 0x03, 0x55, 0x1D, 0x11,
// OCTET STRING (1 element)
0x04, 0x0D, //NOTE: 0x0D = length 13, this needs updated based on string length
// SEQUENCE (1 element)
0x30, 0x0B,
// String, value: "DNS:localhost"
0x82, 0x09, 0x6C, 0x6F, 0x63, 0x61, 0x6C, 0x68,
0x6F, 0x73, 0x74
};
strncpy(myCert.subject.country, "NZ", CTC_NAME_SIZE);
strncpy(myCert.subject.state, "Auckland", CTC_NAME_SIZE);
strncpy(myCert.subject.locality, "CBD", CTC_NAME_SIZE);
strncpy(myCert.subject.org, "Test Ltd", CTC_NAME_SIZE);
strncpy(myCert.subject.unit, "WEB Server", CTC_NAME_SIZE);
XMEMCPY(myCert.altNames, myAltNames, XSTRLEN(myAltNames));
myCert.altNamesSz = (int) sizeof(myAltNames);
myCert.daysValid = 365 * 20;
ret = wc_ecc_make_key(&rng, keyLen / 8, &privKey);
if (ret != 0)
goto error_out;
ret = wc_ecc_make_key(&rng, keyLen / 8, &pubKey);
if (ret != 0)
goto error_out;
myCert.sigType = CTC_SHA256wECDSA;
// ret = wc_SetAltNames(&myCert,"a:/xxx/xxx.pem");
//
// if (ret != 0){
// goto error_out;
// }
certSz = wc_MakeSelfCert(&myCert, certDer, 4096, &rsaKey, &rng);
if(certSz <= 0)
{
ret = 1;
wc_FreeRsaKey(&rsaKey);
goto error_out;
}
certSz = wc_SignCert(myCert.bodySz, myCert.sigType, certDer, 4096, NULL, &privKey, &rng);
if(certSz <= 0)
{
ret = 1;
goto error_out;
}
certPemLen = wc_DerToPem(certDer, certSz, certPem, 4096, CERT_TYPE);
if( certPemLen <= 0 )
{
ret = 1;
goto error_out;
}
keyDerLen = wc_EccKeyToDer(&privKey, keyDer, 4096);
if(keyDerLen <= 0)
{
ret = 1;
goto error_out;
}
keyPemLen = wc_DerToPem(keyDer, keyDerLen, keyPem, 4096, ECC_PRIVATEKEY_TYPE);
if( certPemLen <= 0 )
{
ret = 1;
goto error_out;
}
f = fopen("D:/xxx.crt", "wb");
if (f)
{
unsigned char *ptr = certPem;
do {
ret = fwrite(ptr, 1, certPemLen, f);
if( ret <= 0 )
break;
certPemLen -= ret;
ptr += ret;
} while( certPemLen > 0 );
fclose(f);
}
f = fopen("D:/xxx.key", "wb");
if (f)
{
unsigned char *ptr = keyPem;
do {
ret = fwrite(ptr, 1, keyPemLen, f);
if( ret <= 0 )
break;
keyPemLen -= ret;
ptr += ret;
} while( keyPemLen > 0 );
fclose(f);
}
The part that using wc_SetAltNames is commented out in the code above, please see if I am using it correctly?
Apart from this, I also define the following in the beginning of the asn_public.h to enable the SAN:
#define WOLFSSL_ALT_NAMES
Am I putting the SAN part at the right place? Since u mention that the SAN need to be in ASN.1 format and the Cert structure is not seem to be relative to ASN.1 ....
Looking forward to your reply 
Thanks