Free tools Windows power users keep installed
One-click scans. No signup required.
A SAN certificate is an X.509 certificate whose Subject Alternative Name (SAN) extension lists the identities it covers, such as DNS names or IP addresses. To request one with OpenSSL, define each identity in a configuration file, generate a private key and certificate signing request (CSR), then submit the CSR to a certificate authority (CA). The CA—not the CSR—decides what goes into the issued certificate. Inspect the issued certificate to confirm that every identity clients will use appears under the correct SAN type.
What a SAN certificate is
SAN stands for Subject Alternative Name. In an X.509 certificate, the subjectAltName extension carries a sequence of one or more identities associated with that certificate. It can let a certificate cover multiple names or identity types, rather than relying on a single subject name.
The value is not just a list of text strings. Each entry has a GeneralName type, and the type must match the identity: a hostname is a DNS name, while an IP literal is an IP address. RFC 5280 defines the available GeneralName choices. When the SAN extension is present, it must contain at least one entry; empty GeneralName values are not permitted.
dNSName: a DNS name such asexample.comorwww.example.com.iPAddress: an IP address such as192.0.2.10.rfc822Name: an email address.uniformResourceIdentifier: a URI, which must include a scheme and a scheme-specific part.directoryName,registeredID, andotherName: additional GeneralName forms for identities represented in those formats.
For a website certificate, the practical check is whether the DNS SAN entries cover the hostnames visitors or applications actually use. If a client connects by IP address, that IP must be represented as an IP SAN; an IP written as a DNS SAN is a different type of entry.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
What the CSR does—and does not—guarantee
A CSR contains a public key and a request for a certificate, which can include requested extensions such as SANs. The matching private key stays with the requester and must be protected. A CSR is not itself a certificate, and its requested SANs do not guarantee that those extensions will appear in the final certificate. The issuing CA controls the certificate it issues, including its contents and trust status.
For public use, submit the CSR through the CA’s validation and issuance process. An enterprise, standalone, or third-party CA may have its own requirements for validating requested identities. For a lab, you can create a self-signed certificate instead, but that certificate is not automatically trusted by public browsers or operating systems. Public trust requires an appropriate CA chain.
Prepare an OpenSSL configuration with multiple SANs
Create a file named san.cnf. This example requests two DNS names and one documentation-range IPv4 address; replace them with the identities needed for your environment.
[req]
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no
[req_distinguished_name]
C = US
ST = State
L = City
O = Example Organization
CN = example.com
[req_ext]
subjectAltName = @alt_names
[alt_names]
DNS.1 = example.com
DNS.2 = www.example.com
IP.1 = 192.0.2.10The req section tells OpenSSL where to find the distinguished-name fields and which request-extension section to use. The req_distinguished_name section supplies the request’s identifying fields. The req_ext section points the SAN extension to the named alt_names list.
Recommended Free Tools
Use numbered entries for each value in a type: DNS.1, DNS.2, and so on for DNS names; IP.1, IP.2, and so on for IP addresses. Add every hostname clients will use. If the service is also reached by an IP address, put that address in an IP.n entry. Do not put an IP literal in a DNS.n entry.
The example uses example.com as the common name (CN), but do not treat the CN as a substitute for checking SANs. Verify the SAN extension in the resulting certificate and include the DNS names and IP addresses clients need there. OpenSSL’s x509v3_config configuration vocabulary also supports email, URI, registered ID (RID), directory name, and otherName entries. Select the matching GeneralName form for any such identity; in particular, a URI needs a scheme and scheme-specific part.
Generate the private key and CSR
With san.cnf in the current directory, run:
openssl req -new -newkey rsa:2048 -nodes
-keyout example.key
-out example.csr
-config san.cnf
-reqexts req_extThis command asks OpenSSL to generate a new RSA key and a new CSR, reads configuration from san.cnf, and uses req_ext as the request-extension section. It writes the private key to example.key and the request to example.csr. The -nodes option means the generated key is not encrypted with a passphrase, so protect the file with appropriate access controls and do not expose it. If you need an encrypted key, choose an OpenSSL workflow that protects it and account for the passphrase in the service that will use the key.
Send example.csr to the CA through its documented process. Keep the private key under your control; the CSR is what you submit. The CA may validate the requested names and can issue a certificate with its own extension choices. Once it returns a certificate, inspect that issued file rather than assuming the request and certificate are identical.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Self-sign only for a private test
OpenSSL’s req command can create a self-signed certificate using -x509. For example, this creates a short-lived test certificate from the same configuration:
Rank #4
openssl req -new -x509 -newkey rsa:2048 -nodes
-keyout example-test.key
-out example-test.crt
-config san.cnf
-reqexts req_ext
-days 30Use a self-signed certificate only where the relevant clients are configured to trust it, such as a controlled private test environment. Creating one does not make it publicly trusted. For production public trust, use a certificate issued through an appropriate CA chain.
Inspect the certificate and confirm the SANs
After receiving a certificate, save it as issued-cert.pem and print its full details:
openssl x509 -in issued-cert.pem -text -nooutFind the X509v3 Subject Alternative Name section. Check that every DNS name and IP address clients will use appears there and that each is shown under the appropriate type. A DNS name should appear as a DNS entry; an address used as an IP should appear as an IP entry.
Best Value
- Used Book in Good Condition
To review the certificate’s subject, issuer, and validity dates separately, run:
openssl x509 -in issued-cert.pem -noout -subject -issuer -datesThese commands display certificate contents; they do not establish that a certificate is trusted by a particular client or that a service is configured to present it. For those separate checks, use the relevant CA chain and client or service procedures. The essential SAN check here is direct: the issued certificate must show every required identity in the right GeneralName form.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common SAN certificate errors and fixes
| Symptom or mistake | Why it matters | Fix |
|---|---|---|
An IP literal appears under DNS. |
DNS and IP addresses are distinct GeneralName types. | Put the address in an IP.n entry and generate a new CSR. |
| A hostname used by a client is missing. | The certificate’s SAN list does not cover that requested identity. | Add the hostname as a DNS.n value, request issuance again, and inspect the new certificate. |
| The CSR shows the requested SANs, but the issued certificate does not. | A CSR requests extensions; it does not control the CA’s final certificate contents. | Inspect the issued certificate and resolve the discrepancy with the issuing CA before relying on it. |
| The certificate is self-signed and public clients do not trust it. | A self-signed certificate is not automatically trusted by public browsers or operating systems. | Use it only in a private environment whose clients trust it, or obtain a certificate through an appropriate CA chain for public trust. |
| A URI SAN is rejected or not interpreted as intended. | A URI GeneralName requires a scheme and scheme-specific part. | Use a complete URI value in the URI SAN form supported by OpenSSL’s configuration. |
| The key file is exposed or unavailable when the service needs it. | The private key is the credential corresponding to the CSR’s public key. | Restrict access to the key, keep it out of shared locations, and ensure the service’s deployment process can access the correct matching key. |
If OpenSSL reports a configuration or request-generation error, check that the file path passed to -config exists, that the section named by -reqexts is present, and that subjectAltName points to the exact alternate-name section name. Correct the configuration and rerun the request command. If issuance succeeds but inspection shows missing entries, correct the CA-side issuance request as well as the local configuration; changing san.cnf alone cannot alter an already issued certificate.
Choose an issuance path that matches the trust requirement
The right workflow depends on who must trust the certificate and how names are validated. A self-signed certificate is suitable for a controlled private test when clients can be configured for that trust. A CA-issued certificate is the route for a certificate that needs the trust represented by an appropriate CA chain. The CA may be an enterprise, standalone, or third-party authority, and its validation process governs issuance.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Also decide whether the requested identity set is complete before creating the CSR: list exact DNS names clients will use, identify any IP-based access, and encode each value in its matching SAN form. Wildcard coverage and issuance policy depend on the issuing CA; the configuration example above does not establish what any CA will accept. Follow that CA’s current rules and confirm the contents of its issued certificate rather than assuming a requested name or pattern was approved.
Or skip the browser setup
This article is about certificate requests rather than browser screenshots, but if documenting the certificate workflow calls for a clean capture of a web page, ScreenshotNeo can return an image or PDF from one GET request. It accepts cookie or consent banners and removes more than 60 known consent platforms, newsletter popups, and chat widgets before capture; each cleanup step can be turned off. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, and each response identifies the page verdict and billing status in headers. An MCP server provides take_screenshot, get_page_info, and capture_pdf tools for AI agents and other MCP clients.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com -o shot.webpSee the ScreenshotNeo API documentation for request options. The Free plan includes 1,000 screenshots per month without a card; paid plans start at $5 for 3,000. Learn about ScreenshotNeo or sign up for 1,000 free screenshots a month with no card.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
