DevTransformFREE
Zero-Upload • 100% Client-Side
OpenSSL • Generation & Keys

How to Generate a Certificate Signing Request (CSR) with SAN

Modern browsers and Certificate Authorities (Let's Encrypt, DigiCert, Sectigo) require all domains (including the apex domain and www) to be listed in the Subject Alternative Name (SAN) extension. OpenSSL 1.1.1+ supports the `-addext` flag for instant SAN inclusion.

Generate CSR with SAN Command
Safe • Read-Only / File Generation
openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"
Customize:
Domain:
Cert File:

OpenSSL Flags & Options Explained

-new -newkey rsa:2048Generates new 2048-bit RSA key and CSR simultaneously
-nodesDisables passphrase on the resulting private key
-subj "/CN=example.com"Specifies primary domain name without prompting
-addext "subjectAltName=..."Specifies comma-separated list of SAN domains

Execution Steps & Verification

1Generate key and CSR with SANs

Run the one-liner specifying your primary and alternative domains:

openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"
2Verify the CSR contents

Verify that the SAN extension and Common Name are correctly populated:

openssl req -in domain.csr -text -noout | grep -A 1 "Subject Alternative Name"
3Submit CSR to Certificate Authority

Copy the contents of domain.csr and provide to your CA portal.

Common Security Pitfalls & Solutions

  • If using OpenSSL 1.0.2 or earlier, `-addext` is not supported; you must use an `openssl.cnf` config file with `[req_ext]`.
  • Never send domain.key to anyone! Only domain.csr is shared with the Certificate Authority.

Prerequisites & Environment

  • OpenSSL 1.1.1 or higher for the `-addext` parameter.

Frequently Asked Questions About Generate CSR with SAN

Frequently Asked Questions

Frequently Asked Questions

Everything you need to know regarding specifications, syntax, and security best practices.

Yes! Prefix with `IP:`, e.g. `-addext "subjectAltName=DNS:example.com,IP:192.168.1.100"`.

Related OpenSSL & Security Commands

View All Recipes
Generation & Keys

How to Generate a Self-Signed SSL Certificate with OpenSSL

reqGuide →
Verification & Inspection

How to Check SSL Certificate Expiration Date from Domain or File

s_clientGuide →
Verification & Inspection

How to View and Inspect SSL Certificate Details (Subject, Issuer, SAN)

x509Guide →
Verification & Inspection

How to Verify Private Key Matches SSL Certificate (Modulus MD5 Check)

x509Guide →
Format Conversions

How to Convert PFX / PKCS#12 to PEM Certificate and Private Key

pkcs12Guide →
Format Conversions

How to Convert CRT, CER or DER to PEM Format

x509Guide →