Creating a multi-domain (SAN) SSL certificate signing request


  1. Use SSH to log in to the QRadar® Console.
  2. Create and save a sancert.conf configuration file containing the following information:
    [ req ]
    default_bits            = 2048  # RSA key size
    encrypt_key             = no  # Protect private key
    default_md              = sha256  # MD to use
    utf8                    = yes  # Input is UTF-8
    string_mask             = utf8only  # Emit UTF-8 strings
    prompt                  = no  # Prompt for DN
    distinguished_name      = server_dn  # DN template
    req_extensions          = server_reqext  # Desired extensions
    [ server_dn ]
    countryName             = <country_or_region_code>  # ISO 3166
    stateOrProvinceName     = <state_or_province>
    localityName            = <city_or_locality>
    organizationName        = <organization_name>
    organizationalUnitName  = <organizational_unit_name>
    commonName              = <common_name>  # Should match a SAN under alt_names
    [ server_reqext ]
    basicConstraints        = CA:FALSE
    keyUsage                = critical,digitalSignature,keyEncipherment
    extendedKeyUsage        = serverAuth
    subjectKeyIdentifier    = hash
    subjectAltName          = @alt_names
    DNS.1			=  #Example
    DNS.2			=  #Example
    IP.3			 =  #Example
  3. Generate a private key and public certificate signing request (CSR) pair by using the following command:
    openssl req -new -nodes -sha256 -out <csr_filename>.csr -config sancert.conf 
    -keyout <privatekey_filename>.key

    The CSR file is used to create the SSL certificate, with either an internal CA or commercial certificate authorities The key file is created in the current directory. Keep this file to use when you install the certificate.

  4. If you want to verify the information in the CSR before you send it, type the following command:
    openssl req -noout -text -in <csr_filename>.csr

    If incorrect information was entered, update the sancert.conf configuration file and repeat the previous step.

  5. Use the Secure File Transfer Protocol or another program to securely copy the CSR file to your computer.
  6. Submit the CSR to your internal or commercial certificate authority for signing, according to their instructions.
    Note: The CSR is identified as a certificate in Apache format.