Adding SAN to CSR?

[Scepticalist]

Hi - I'm Is there an equivalent in PSPKI of the following, which amends a CSR and authorises it, so that the new CSR can be submitted later?

certreq -policy -config CAserver/CAInstance PathToCSR.csr InfFilewithSANsettings.inf PathToNewCSRFile.csr

Where the Inf file is formatted as:

[Extensions]
2.5.29.17 = {"text"}
_continue_ = {dns="san1.fqdn"&"}

etc

Loving your module, many thanks

[Crypt32]

There is no built-in functionality to create certificate requests. You may need to use certreq with INF template.

[Scepticalist]

Yeh, was looking for a way to script it without certreq dependency.

We automatically issue certs when requested, else I could amend the cert before issue, which is why I want to amend the CSR.

Thanks

[Crypt32]

Yeh, was looking for a way to script it without certreq dependency.

We automatically issue certs when requested, else I could amend the cert before issue, which is why I want to amend the CSR.

Thanks

you cannot amend request, because it is digitally signed. By editing CSR you break signature. You can edit extensions on CA when request is placed in pending requests folder. You can use Set-CertificateExtension command for this scenario.

[Scepticalist]

Yeh, was looking for a way to script it without certreq dependency.
We automatically issue certs when requested, else I could amend the cert before issue, which is why I want to amend the CSR.
Thanks

you cannot amend request, because it is digitally signed. By editing CSR you break signature. You can edit extensions on CA when request is placed in pending requests folder. You can use Set-CertificateExtension command for this scenario.

You can the amend request - with certreq command as I specified above, the command returns a new CSR which you can then submit. - I do it regularly, try it yourself.

I'm assuming that the CA is effectively appending the requirement to the CSR file, which it recognises and actions when you submit it.

[BZanten]

@Scepticalist Maybe I can jump in here.

I was looking for a similar feature, and found the following: there is a Policy module published, called TameMyCerts on: https://github.com/Sleepw4lker/TameMyCerts that not only allows to block issuing requests based on certain properties, but is also able to enhance the incoming CSR with additional fields such as Organisation name or SAN just before signing it.
I'm using this policy module successfully to enhance my webserver certificates with a correct SAN even it they are not in the original CSR.
It is documented on Uwe's website on https://www.gradenegger.eu/en/day/policy-module/

[Sleepw4lker]

Maybe this is also an option if the SID shall be part of the CSR.
Cheers

[Crypt32]

Maybe this is also an option if the SID shall be part of the CSR. Cheers

I'm not sure if SID extension support was requested here.