Scenarij 2.3: Ustvarjanje Multi-SAN CSR

Ta scenarij opisuje ustvarjanje CSR z več Subject Alternative Names (SANs). To je potrebno za certifikate, ki naj varujejo več domen, poddomen ali IP-naslovov.

Primeri uporabe:

• Multi-domenski certifikati (SAN-certifikati)
• Wildcard + eksplicitne domene kombinirano
• Notranja + zunanja imena
• Load balancer z več zaledji

using WvdS.Security.Cryptography.X509Certificates.Extensions.PQ;
 
using var ctx = PqCryptoContext.Initialize();
using var key = ctx.GenerateKeyPair(PqAlgorithm.MlDsa65);
 
var dn = new DnBuilder()
    .AddCN("example.com")  // Primarna domena
    .AddO("Example d.o.o.")
    .AddC("SI")
    .Build();
 
// Multi-SAN z različnimi tipi
var extensions = new ExtBuilder()
    .SubjectAlternativeName(new[] {
        // DNS-imena
        "dns:example.com",
        "dns:www.example.com",
        "dns:api.example.com",
        "dns:app.example.com",
        "dns:*.dev.example.com",      // Wildcard za dev
 
        // IP-naslovi (za notranje dostope)
        "ip:10.0.0.100",
        "ip:192.168.1.50",
 
        // IPv6
        "ip:2001:db8::1"
    })
    .KeyUsage(KeyUsageFlags.DigitalSignature | KeyUsageFlags.KeyEncipherment)
    .ExtendedKeyUsage(ExtKeyUsage.ServerAuth)
    .Build();
 
var csr = ctx.CreateCertificateRequest(key, dn, extensions);
 
// Izpis vseh SAN-ov
Console.WriteLine("Subject Alternative Names:");
foreach (var san in csr.SubjectAlternativeNames)
{
    Console.WriteLine($"  - {san}");
}
 
File.WriteAllText("multi-san.csr.pem", csr.ToPem());

var extensions = new ExtBuilder()
    .SubjectAlternativeName(new[] {
        "dns:example.com",           // Korenska domena (wildcard je ne pokrije!)
        "dns:*.example.com",         // Vse poddomene 1. ravni
        "dns:*.api.example.com",     // API-poddomene
        "dns:legacy.old-domain.com"  // Alternativna domena
    })
    .Build();

var extensions = new ExtBuilder()
    .SubjectAlternativeName(new[] {
        // Kubernetes Service DNS
        "dns:my-service",
        "dns:my-service.default",
        "dns:my-service.default.svc",
        "dns:my-service.default.svc.cluster.local",
 
        // Headless Service (Pod DNS)
        "dns:*.my-service.default.svc.cluster.local",
 
        // Zunanja Ingress domena
        "dns:api.example.com"
    })
    .Build();

« 2.2 Odjemalčev CSR | Pregled CSR | 2.4 Obdelava CSR »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional