Hashicorp Vault SSL Subject Alternative Name in certificates

user_3844262 0
Viewed 2427

Dear stackoverflow community,

we're looking for a solution for generating SSL server and client certificates with HashiCorp vault like this:

X509v3 Subject Alternative Name: DNS:myhostname.mydomain.com, DNS:myhostname

Basically we just want to add as many DNS entries/hostnames as we want to the certificate.

What we achieved so far is that Vault generates the certificate SAN like this:

X509v3 Subject Alternative Name: DNS:foobar.mydomain.com, URI:foobar, URI:barfoo

Vault CLI command:  vault write pki/issue/server common_name="foobar.mydomain.com" ttl=2h alt_names="foobar,barfoo"

Any chance to get the first version running with vault? We're struggling to find the correct parameter or even the correct way to achieve this.

Could spend someone a little effort and time explaining this to us?

Many thanks and best regards Matt

hashicorp-vault certificate ssl
1 Answers

If I understand the question correctly, you want to use Vault to sign certificates with URI alternate names.

The relevant documentation is here...

There are two parts to it.

  1. you have to have a PKI role that allows the URI sans, use the allowed_uri_sans property when you create the "server" role - you'll need to allow each of the alternate names.
  2. when you use vault to issue the cert, supply a uri_sans argument.

The vault command would look something like:

vault write pki/issue/server common_name="foobar.mydomain.com" ttl=2h uri_sans="foobar,barfoo"
user_20787010
Related