Help me generate a certificate with a proper SAN and no COMMON NAME

Vault
1

I’m attempting to create a role and generate a certificate for a Golang mtls-setup (running in docker swarm).

In this example, there’s a server at mtls-server.company_net and a client at mtls-server.company_net.

1 - Generating certificates with

vault write pki_int/issue/mtls_provider \
  alt_names=mtls-server.company_net \
  uri_sans=mtls-server.company_net \
  ttl="24h"

the go-code will complain that

x509: certificate is not valid for any names, but wanted to match mtls-server.company_net

2 - Generating certificates with

vault write pki_int/issue/mtls_provider \
  common_name=mtls-client.company_net \
  alt_names=mtls-server.company_net \
  uri_sans=mtls-server.company_net \
  ttl="24h"

the go-code will complain that

x509: certificate relies on legacy Common Name field, use SANs instead

The certificate does contain the following

            X509v3 Subject Alternative Name:
                URI:mtls-server.company_net

I guess I need DNS:mtls-server.company_net ?
Newbie alert!

2

You need a common name for the certificate but nothing says that the name must be in DNS - even if it was you can get around it by definining it locally in your hosts file.

Then use SAN for the DNS name and actual use. It’s an odd way of doing but you can technically do it.