<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=EN-US link=blue vlink="#954F72"><div class=WordSection1><p class=MsoNormal>yes</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Sent from <a href="https://go.microsoft.com/fwlink/?LinkId=550986">Mail</a> for Windows 10</p><p class=MsoNormal><o:p> </o:p></p><div style='mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal style='border:none;padding:0in'><b>From: </b><a href="mailto:murrayr@dor.state.ma.us">Murray, Ronald-1 (ANF)</a><br><b>Sent: </b>Wednesday, April 26, 2017 1:25 PM<br><b>To: </b><a href="mailto:openssl-users@openssl.org">'openssl-users@openssl.org'</a><br><b>Subject: </b>[openssl-users] RFC2818 and subjectAltName</p></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We had an issue a few days ago when people with the newest version of Chrome were seeing security errors on our internal sites which were using SSL certificates signed with our internal CA. This turned out to be caused by Google adhering to RFC2818, which says:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'>If a subjectAltName extension of type dNSName is present, that MUST<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>be used as the identity. Otherwise, the (most specific) Common Name<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>field in the Subject field of the certificate MUST be used. Although<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>the use of the Common Name is existing practice, it is deprecated and<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>Certification Authorities are encouraged to use the dNSName instead.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Our certificates, of course, only contained the Common Name (CN), with no subjectAltName (SAN). I solved the problem by creating new certificates and hacking openssl.cnf to request a SAN in the CSR.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Now, our CA isn’t openssl-based (it’s Microsoft), but it’s occurred to me that openssl-created certificates should really include the site ID in a SAN as well as in the CN. RFC2818 has been out since May, 2000, so I’m rather surprised that this hasn’t been widely implemented before now. I note that certificates we get from Symantec have lately included a SAN, but I think that’s quite recent.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Is there any chance of this being included in openssl?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><img border=0 width=708 height=1 style='width:7.375in;height:.0104in' id="Horizontal_x0020_Line_x0020_1" src="cid:image002.png@01D2BE95.AA09CFE0"><o:p></o:p></p><p class=MsoNormal>This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this mail in error please notify the postmaster at dor.state.ma.us.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>