Generating a SAN CSR in PHP

Question

I am currently writing a script to generate CSRs through a web interface for submission to generate a certificate. My current issue is that I want to generate a SAN certificate but I can't find any information on how to add the subjectAlternateName into the generated certificate request.

My current code is:

$private_key = openssl_pkey_new( array( 'private_key_bits' => 2048 ) );
$domain_data = [
    "countryName"            => 'GB',
    "stateOrProvinceName"    => 'Countyname',
    "localityName"           => 'townname',
    "organizationName"       => 'Company ltd.',
    "organizationalUnitName" => "IT",
    "emailAddress"           => '[e-mail]',
    "commonName"             => 'example.com',
];
$config_args = ['private_key_bits' => 2048];
$attributes = [];

$csr = openssl_csr_new( $domain_data, $private_key, $config_args, $attributes );

openssl_csr_export( $csr, $csr_out );

Adding subjectAlternateName into the $domain_data array doesn't appear to add anything into the CSR when I parse it later.

Is it possible to do this directly in PHP?

Answer 1

I have managed to solve this by generating a temporary copy of my openssl.cnf file with the subjectAltName line injected into it. This config can then be loaded by setting $config_args['config'] = $temporaryfilepath