nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How to add subject alternates to New-NcSecurityCertificateCSR

jamesfort89

When looking through this documentation, it doesn't describe how to put these in, but it lists the input as <DataONTAP.C.Types.SecurityCertificate.SubjectAlternatives>. I don't see any documentation on this kind of input or how to generate it.

Without this, the signed certificates are worthless as they still trip the browser's warning that there's a problem with the certificate. Is there any documentation on how to configure this parameter?

Find more posts tagged with

Hyper-V

Accepted answers

mbeattie

Hi James,

I reached out to the developers internally for you and got an example of the CmdLet syntax to use. Can you please try this and let me know if that resolves the issue for you?

$a = New-Object DataONTAP.C.Types.SecurityCertificate.SubjectAlternatives
$a.Email = admin@testlab.local
$a.Dns = "svm1.testlab.local"
$a.Ip = "10.24.27.128"
$a.Uri = http://testlab.local
New-NcSecurityCertificateCsr -CommonName "C=US,O=NTAP,CN=test.testlab.local" -SubjectAlternatives $a

Modify variables to match your environment. Hope this helps

/Matt

All comments

mbeattie

Hi James,

You specify the Subject Alternative Names during the signing process. This can be done using the "certreq.exe" command. EG:

"certreq.exe -f -q -config ""$CertReqconfig"" &ndash;submit &ndash;attrib ""CertificateTemplate:$Template\nSAN:dns=$VserverName&dns=$fqdn$ipList"" ""$CsrPath.csr"" ""$SignedPath.cer"""

/Matt

jamesfort89

That doesn't work for my environment. I added the info into the certreq command, but it's ignored by the CA since the info isn't in the CSR to begin with. I don't have control over the CA environment, so I need to be able to put the info inside the CSR when it's created.

mbeattie

Hi James,

Have you considered invoking the REST API directly to ONTAP for creating the CSR instead of invoking the "New-NcSecurityCertificateCSR" CmdLet as the REST API POST method for "/security/certificate-signing-request" does enable the subject alternative name. EG:

{
  "_links": {},
  "algorithm": "rsa",
  "extended_key_usages": [
    "serverauth"
  ],
  "hash_function": "sha256",
  "key_usages": [
    "digitalsignature"
  ],
  "security_strength": 112,
  "subject_alternatives": {
    "dns": [
      "*.example.com"
    ],
    "email": [
      "abc@example.com"
    ],
    "ip": [
      "10.225.34.10"
    ],
    "uri": [
      "http://example.com"
    ]
  },
  "subject_name": "C=US,O=NTAP,CN=test.domain.com"
}

/Matt

mbeattie

Hi James,

I reached out to the developers internally for you and got an example of the CmdLet syntax to use. Can you please try this and let me know if that resolves the issue for you?

$a = New-Object DataONTAP.C.Types.SecurityCertificate.SubjectAlternatives
$a.Email = admin@testlab.local
$a.Dns = "svm1.testlab.local"
$a.Ip = "10.24.27.128"
$a.Uri = http://testlab.local
New-NcSecurityCertificateCsr -CommonName "C=US,O=NTAP,CN=test.testlab.local" -SubjectAlternatives $a

Modify variables to match your environment. Hope this helps

/Matt

jamesfort89

So, I did figure out the subjectalternates object with a little tinkering. What was not clear was the structure of the common name.

Also, I did find that all of the fields of the subject alternates needed to be filled out in order for it to work. Otherwise, I got this error:

New-NcSecurityCertificateCsr : [400]: Certificate Authority requires a common name or one or more of the following SAN extensions: rfc822-name, uri, dns-name, ipaddr.

I did also find that it'll take just "CN=name.org.com" as the common name attribute.

This is what I needed though. The command example given in the docs isn't updated to include this structure. Thank you!

mbeattie

Add this code to save the CSR and PrivateKey to files in the scripts working directory:

#'------------------------------------------------------------------------------
#'Save the CSR and Private Key for the SVM to files in the scripts working directory.
#'------------------------------------------------------------------------------
[String]$scriptPath = Split-Path($MyInvocation.MyCommand.Path)
[String]$svm = $SubjectName.Split(".")[0].Replace("CN=", "")
If($Null -ne $respone.csr){
   Try{
      New-Item -Path "$scriptPath\$svm.csr" -Type file -Value $response.csr -Force -ErrorAction Stop | Out-Null
   }Catch{
      Write-Warning -Message $("Failed creating CSR for vserver ""$svm"". Error " + $_.Exception.Message)
      Break;
   }
}Else{
   Write-Warning -Message "The CSR for vserver ""$svm"" is invalid"
   Break;
}
If($Null -ne $respone.generated_private_key){
   Try{
      New-Item -Path "$scriptPath\$svm.ppk" -Type file -Value $response.generated_private_key -Force -ErrorAction Stop | Out-Null
   }Catch{
      Write-Warning -Message $("Failed creating Private Key for vserver ""$svm"". Error " + $_.Exception.Message)
      Break;
   }
}Else{
   Write-Warning -Message "The Private Key for vserver ""$svm"" is invalid"
   Break;
}
#'------------------------------------------------------------------------------