SSL Certificate - Setting Subject Alternate Names using IIS

Article
2014-07-15

Question

_{Tuesday, July 15, 2014 7:06 AM}

Hi everyone,

I need to move my multi domain SSL certificate to my VM hosting.
We've created a n SSL certificate but we can't add Subject alternative names that can host the other domain name variations. How can we do this?

Thanks for your help

All replies (3)

_{Tuesday, July 15, 2014 12:45 PM ✅Answered}

Hi,

When someone visits a web site using HTTPS, the communication between the web site and the browser is secured using Secure Socket Layer (SSL) encryption.

This is the most commonly used method of securing data sent across the internet, and assures visitors that their transactions with your site are secure.

Note : In order to enable HTTPS for custom domain names, you must configure your web sites for standard mode. This may incur additional costs if you are currently using free or shared mode.

OpenSSL can be used to create a certificate request that uses the SubjectAltName extension to support multiple domain names with a single certificate, however it requires a configuration file.

The following steps walk through creating a configuration file, and then using it to request a certificate.

**1.**Create a new file named sancert.cnf and use the following as the contents of the file

BEGIN CERTIFICATE
MIIDJDCCAgwCCQCpCY4o1LBQuzANBgkqhkiG9w0BAQUFADBUMQswCQYDVQQGEwJV
UzELMAkGA1UECBMCV0ExEDAOBgNVBAcTB1JlZG1vbmQxEDAOBgNVBAsTB0NvbnRv
c28xFDASBgNVBAMTC2NvbnRvc28uY29tMB4XDTE0MDExNjE1MzIyM1oXDTE1MDEx
NjE1MzIyM1owVDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdS
ZWRtb25kMRAwDgYDVQQLEwdDb250b3NvMRQwEgYDVQQDEwtjb250b3NvLmNvbTCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN96hBX5EDgULtWkCRK7DMM3
enae1LT9fXqGlbA7ScFvFivGvOLEqEPD//eLGsf15OYHFOQHK1hwgyfXa9sEDPMT
3AsF3iWyF7FiEoR/qV6LdKjeQicJ2cXjGwf3G5vPoIaYifI5r0lhgOUqBxzaBDZ4
xMgCh4yv7NavI17BHlWyQo90gS2X5glYGRhzY/fGp10BeUEgIs3Se0kQfBQOFUYb
ktA6802lod5K0OxlQy4Oc8kfxTDf8AF2SPQ6BL7xxWrNl/Q2DuEEemjuMnLNxmeA
Ik2+6Z6+WdvJoRxqHhleoL8ftOpWR20ToiZXCPo+fcmLod4ejsG5qjBlztVY4qsC
AwEAATANBgkqhkiG9w0BAQUFAAOCAQEAVcM9AeeNFv2li69qBZLGDuK0NDHD3zhK
Y0nDkqucgjE2QKUuvVSPodz8qwHnKoPwnSrTn8CRjW1gFq5qWEO50dGWgyLR8Wy1
F69DYsEzodG+shv/G+vHJZg9QzutsJTB/Q8OoUCSnQS1PSPZP7RbvDV9b7Gx+gtg
7kQ55j3A5vOrpI8N9CwdPuimtu6X8Ylw9ejWZsnyy0FMeOPpK3WTkDMxwwGxkU3Y
lCRTzkv6vnHrlYQxyBLOSafCB1RWinN/slcWSLHADB6R+HeMiVKkFpooT+ghtii1
A9PdUQIhK9bdaFicXPBYZ6AgNVuGtfwyuS5V6ucm7RE6+qf+QjXNFg==
END CERTIFICATE

** The line must begin with 'subjectAltName'.

** Replace the domain names currently listed with domain names you wish to support in addition to the common name. For Example

openssl pkcs12 -export -out myserver.pfx -inkey myserver.key -in myserver.crt

(You do not need to change the commonName_default field, as you will be prompted to enter your common name in one of the following steps.)

**2.**Save the sancert.cnf file.

**3.**Generate a private key and Certificate Signing Request by using the sancert.cnf configuration file. From a bash or terminal session, use the following command:

openssl req -new -nodes -keyout myserver.key -out server.csr -newkey rsa:2048 -config sancert.cnf

**4.**When prompted, enter the appropriate information. For example:

Country Name (2 letter code) []: US
State or Province Name (full name) []: Washington
Locality Name (eg, city) []: Redmond
Organizational Unit Name (eg, section) []: Azure
Your common name (eg, domain name) []: www.microsoft.com

Once this process completes, you should have two files; myserver.key and server.csr. The server.csr contains the Certificate Signing Request.

**5.**Submit your CSR to a Certificate Authority to obtain an SSL certificate.

**6.**Once you have obtained a certificate from a CA, save it to a file named myserver.crt. If your CA provided the certificate in a text format, simply paste the certificate text into the myserver.crt file. The file contents should be similar to the following when viewed in a text editor:

BEGIN CERTIFICATE
MIIDJDCCAgwCCQCpCY4o1LBQuzANBgkqhkiG9w0BAQUFADBUMQswCQYDVQQGEwJV
UzELMAkGA1UECBMCV0ExEDAOBgNVBAcTB1JlZG1vbmQxEDAOBgNVBAsTB0NvbnRv
c28xFDASBgNVBAMTC2NvbnRvc28uY29tMB4XDTE0MDExNjE1MzIyM1oXDTE1MDEx
NjE1MzIyM1owVDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdS
ZWRtb25kMRAwDgYDVQQLEwdDb250b3NvMRQwEgYDVQQDEwtjb250b3NvLmNvbTCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN96hBX5EDgULtWkCRK7DMM3
enae1LT9fXqGlbA7ScFvFivGvOLEqEPD//eLGsf15OYHFOQHK1hwgyfXa9sEDPMT
3AsF3iWyF7FiEoR/qV6LdKjeQicJ2cXjGwf3G5vPoIaYifI5r0lhgOUqBxzaBDZ4
xMgCh4yv7NavI17BHlWyQo90gS2X5glYGRhzY/fGp10BeUEgIs3Se0kQfBQOFUYb
ktA6802lod5K0OxlQy4Oc8kfxTDf8AF2SPQ6BL7xxWrNl/Q2DuEEemjuMnLNxmeA
Ik2+6Z6+WdvJoRxqHhleoL8ftOpWR20ToiZXCPo+fcmLod4ejsG5qjBlztVY4qsC
AwEAATANBgkqhkiG9w0BAQUFAAOCAQEAVcM9AeeNFv2li69qBZLGDuK0NDHD3zhK
Y0nDkqucgjE2QKUuvVSPodz8qwHnKoPwnSrTn8CRjW1gFq5qWEO50dGWgyLR8Wy1
F69DYsEzodG+shv/G+vHJZg9QzutsJTB/Q8OoUCSnQS1PSPZP7RbvDV9b7Gx+gtg
7kQ55j3A5vOrpI8N9CwdPuimtu6X8Ylw9ejWZsnyy0FMeOPpK3WTkDMxwwGxkU3Y
lCRTzkv6vnHrlYQxyBLOSafCB1RWinN/slcWSLHADB6R+HeMiVKkFpooT+ghtii1
A9PdUQIhK9bdaFicXPBYZ6AgNVuGtfwyuS5V6ucm7RE6+qf+QjXNFg==
END CERTIFICATE

Save the file.

**7.**From the command-line, Bash or terminal session, use the following command to convert the myserver.key andmyserver.crt into myserver.pfx, which is the format required by Azure Web Sites:

openssl pkcs12 -export -out myserver.pfx -inkey myserver.key -in myserver.crt

** When prompted, enter a password to secure the .pfx file.

If you are windows friendly, please find the below link which could be useful

http://azure.microsoft.com/en-us/documentation/articles/web-sites-configure-ssl-certificate/

( Refer to Section : Get a certificate using Certreq.exe (Windows only) )

Hope this helps

Regards,

Sowmya

_{Tuesday, July 15, 2014 12:04 PM}

http://www.digicert.com/ssl-support/ssl-host-headers-iis-8.htm ?

_{Wednesday, July 16, 2014 8:01 AM}

Hi,