<div dir="ltr">So I discovered that if I manually sign the csr generated by the rhn-ssl-tool, the generated certificate has the SAN information in it.<div><br></div><div>I'm guessing that the rhn-ssl-tool probably is missing something from the command line for signing. I've gone ahead and opened a support case with Red Hat for this.</div>
<div>
<p class=""># openssl x509 -req -days 3650 -in server.csr -signkey server.key -out /tmp/server.crt -extensions v3_req -extfile rhn-server-openssl.cnf<br>
Signature ok<br>
subject=<subject><br>
Getting Private key<br>
# openssl x509 -text -in /tmp/server.crt -noout<br>
...<br>
X509v3 extensions:<br>
X509v3 Basic Constraints: <br>
CA:FALSE<br>
X509v3 Key Usage: <br>
Digital Signature, Non Repudiation, Key Encipherment<br>
X509v3 Subject Alternative Name: <br>
DNS:<Name 1>, DNS:<Name 2>, DNS:<Name 3></p></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, May 23, 2014 at 10:19 AM, wm-lists <span dir="ltr"><<a href="mailto:wm-lists@nixpeeps.com" target="_blank">wm-lists@nixpeeps.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thanks for the response Justin. So I've been messing w/ the rhn-ssl-tool this morning to generate new webserver certs with SAN's in them. I can see in the .cnf file that the names are there<br>
<div>
# pages where one requests the certificate...</div><div>subjectAltName = @alt_names</div><div><br></div><div>[alt_names]</div><div>DNS.1 =<name1></div><div>DNS.2 =<name2></div><div>DNS.3 =<name3></div>
<div>DNS.4 = <name4><br><br></div><div>and I can see in the associated .csr file that the x509 output has the names<br><div> X509v3 Subject Alternative Name: </div><div> DNS:<name 1>, DNS:<name 2>, DNS:<name 3>, DNS:<name 4></div>
</div><div><br></div><div>But I don't see any output in the .crt file that would indiicate the existence of SAN's</div><div><br></div><div>Should the .crt file have this information in it?</div><div><br></div><div>
<div> X509v3 extensions:</div><div> X509v3 Basic Constraints: </div><div> CA:FALSE</div><div> X509v3 Key Usage: </div><div> Digital Signature, Key Encipherment</div>
<div> X509v3 Extended Key Usage: </div><div> TLS Web Server Authentication, TLS Web Client Authentication</div><div> Netscape Cert Type: </div><div> SSL Server</div><div>
Netscape Comment: </div><div> RHN SSL Tool Generated Certificate</div><div> X509v3 Subject Key Identifier: </div><div> <numbers></div><div> X509v3 Authority Key Identifier: </div>
<div> keyid:<key></div><div> DirName<dir stuff></div><div> serial:<serial></div></div><div><br></div><div><br></div><div>Thanks for any input...</div><div><br>
</div><div>Will</div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, May 16, 2014 at 2:55 PM, Justin Edmands <span dir="ltr"><<a href="mailto:shockwavecs@gmail.com" target="_blank">shockwavecs@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>On Fri, May 16, 2014 at 12:36 PM, wm-lists <span dir="ltr"><<a href="mailto:wm-lists@nixpeeps.com" target="_blank">wm-lists@nixpeeps.com</a>></span> wrote:<br>
</div></div><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div><div dir="ltr">I'm in the process of placing my satellite server and its passive backup at our DR location behind a VIP address (<a href="http://rhn.domain.net" target="_blank">rhn.domain.net</a>). The VIP will forward traffic to whichever satellite is running (DR or Primary). I've already got the failover/backup db part figured out. <div>
What I'm trying to figure out is whether I need to do a spacewalk-hostname-rename on the primary satellite server and give it the new VIP name or is there a better process for this. </div><div><br></div><div>The idea is that I can configure the DR server w/ the same SSL configuration, restore the current db backup to the DR location and start up satellite there in the event something happens to our primary server.</div>
<div><br></div><div>Any thoughts about how to handle this?</div><div><br></div><div>Thanks!</div><div>Will</div></div>
<br></div></div>_______________________________________________<br>
Spacewalk-list mailing list<br>
<a href="mailto:Spacewalk-list@redhat.com" target="_blank">Spacewalk-list@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" target="_blank">https://www.redhat.com/mailman/listinfo/spacewalk-list</a><br></blockquote><div><br>Well since you said the main reason is for SSL, just use a SAN. Subject
Alternative Name. If self signed, you can use quite a few. If provided by 3rd
party, I think most limit it to 5 SANs per cert.<br></div></div><br></div></div>
<br>_______________________________________________<br>
Spacewalk-list mailing list<br>
<a href="mailto:Spacewalk-list@redhat.com" target="_blank">Spacewalk-list@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" target="_blank">https://www.redhat.com/mailman/listinfo/spacewalk-list</a><br></blockquote></div><br></div>
</div></div></blockquote></div><br></div>