0

openSUSE and SLES dropped their old CA management, now recommending to use xca.

While it was easy to add alternate subject names like hostname aliases or IP addresses in the old CA management, I could not find a way how to do it in xca.

So I wonder: Is is possible, and if so, how?

U. Windl
  • 366
  • 3
  • 17
  • On migration: I think it could have been answered at Super User, too (and it would be "on-topic", right?). – U. Windl Aug 28 '23 at 21:38

1 Answers1

0

https://hohnstaedt.de/xca-doc/html/certificate-input.html#wizard points you to https://www.openssl.org/docs/manmaster/man5/x509v3_config.html

which gives some examples of the config for specifying SAN values

subjectAltName = email:copy, email:my@example.com, URI:http://my.example.com/

subjectAltName = IP:192.168.7.1

subjectAltName = IP:13::17

subjectAltName = email:my@example.com, RID:1.2.3.4

subjectAltName = otherName:1.2.3.4;UTF8:some other identifier

[extensions]
subjectAltName = dirName:dir_sect

[dir_sect]
C = UK
O = My Organization
OU = My Unit
CN = My Name
mfinni
  • 36,144
  • 4
  • 53
  • 86
  • Well, I have a script working with openssl commands directly. The old YaST CA management would easily allow adding host aliases and lists of IP addresses (among others). `xca`seems to have a nice user interface, but how to add alternate names looks quite like a mystery to me. "*The subject-alternative-name extension must be used to define additional DNS names, even wildcards*" is quite vague. – U. Windl Aug 28 '23 at 21:43