Bug #71050 [Com]: SubjectAltName (SAN) is Not included in openssl_csr_sign of a new CSR

Edit report at https://bugs.php.net/bug.php?id=71050&edit=1

 ID:                 71050
 Comment by:         bouvrette dot nicolas at gmail dot com
 Reported by:        jimmmaaay at hotmail dot com
 Summary:            SubjectAltName (SAN) is Not included in
                     openssl_csr_sign of a new CSR
 Status:             Open
 Type:               Bug
 Package:            OpenSSL related
 Operating System:   Windows & CentOS 6.7
 PHP Version:        7.0.0
 Block user comment: N
 Private report:     N

 New Comment:

This seems especially annoying for modern certificate management solutions such as ACME (letsencrypt.org). All PHP libraries trying to implement ACME end up with horrible hacks while other languages seems to be handling this nicely

Maybe its time to fix this?


Previous Comments:
------------------------------------------------------------------------
[2016-01-08 00:26:26] doldev at snowgarden dot ch

This is not a bug.

Even though the CSR contains the Subject Alternative Name it's up to the CA (Certificate Authority) to include the x509 extension (in your case Subject Alternative Name) requested in the CSR.
To openssl_csr_sign function is not copying the x509 extensions to the certificate. This behavior needs to be configured as well in the openssl.cnf.

Addition to the '[ req ]' config settings you need a '[ ca ]' section [1]. A basic configuration example can be found here [2]. Similar to your 'req' config 
a 'subjectAltName' must be added. For a self signed I recommend setting 'basicConstraints' [3] as well.
Similar to openssl_csr_new you have to define the 'config' parameter for openssl_csr_sign.

IMHO this bug can be closed. I hope it clear that the certificate not automatically inherits all the x509 extensions from the CSR. This would be very dangerous. Especially if someone could trick a CA to generate a certificate with the basicConstraints=CA:TRUE, which is comparable to an intermediate certificate.

[1] https://github.com/openssl/openssl/blob/2cc7acd273bc39f1360aed52400d18bb65b88a95/apps/openssl.cnf#L36
[2] https://www.openssl.org/docs/manmaster/apps/ca.html#EXAMPLES
[3] https://www.openssl.org/docs/manmaster/apps/x509v3_config.html#Basic-Constraints

------------------------------------------------------------------------
[2015-12-07 12:37:07] jimmmaaay at hotmail dot com

Description:
------------
When creating a new CSR and self-signing it. The SAN (Subject Alternative Name) is not included .

---
From manual page: http://www.php.net/function.openssl-csr-sign
---


Test script:
---------------
$certificate_key_private_resource=openssl_pkey_new(["digest_alg"=>"sha256","private_key_bits"=>2048,"private_key_type"=>OPENSSL_KEYTYPE_RSA]);
$csr=openssl_csr_new(["countryName"=>'CA',"stateOrProvinceName"=>'State',"localityName"=>'City',"organizationName"=>'Company','organizationalUnitName'=>'Unit',"commonName"=>'example.org',"emailAddress"=>'[email protected]'],$certificate_key_private_resource,['config'=>'CUSTOM_CONFIG_FILE_PATH']);
$sscert=openssl_csr_sign($csr,null,$certificate_key_private_resource,365);openssl_x509_export($sscert,$c,false);
echo $c;




----------------------------
OPENSSL CUSTOM CONFIG FILE 
----------------------------

[ req ]
default_bits        = 2048
default_keyfile     = privkey.pem
distinguished_name  = req_distinguished_name
req_extensions     = req_ext 

[ req_distinguished_name ]
countryName           = Country Name (2 letter code)
countryName_default   = US
stateOrProvinceName   = State or Province Name (full name)
stateOrProvinceName_default = Illinois
localityName          = Locality Name (eg, city)
localityName_default  = Chicago
organizationName          = Organization Name (eg, company)
organizationName_default  = Example, Co.
commonName            = Common Name (eg, YOUR name)
commonName_max        = 64

[ req_ext ]
subjectAltName          = @alt_names

[alt_names]
DNS.1 = exmaple.org
DNS.2 = www.example.org


----------------------------
OPENSSL CUSTOM CONFIG FILE END 
----------------------------




Expected result:
----------------
outputted cert should contain Subject Alternative Name

Actual result:
--------------
outputted cert does not contain Subject Alternative Name


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=71050&edit=1