[ci skip] README: generate SSL certificate with SAN field (#57)

diff --git a/README.md b/README.md
index 238b299b031d4e93cb0c241ad49b13e767e9da3b..2ff6f89dd685903ee533b9d672360c5c24f2acdc 100644 (file)
--- a/README.md
+++ b/README.md
@@ -124,14 +124,16 @@ Generate SSL CA and self signed server/client certificates:
 
 ```bash
 # CA certificate (FQDN must be different from server/client)
-openssl genrsa -out ca.key 4096
-openssl req -new -x509 -days 365 -key ca.key -out ca.crt
-# server certificate
-openssl req -newkey rsa:2048 -nodes -keyout server.key -out server.csr
-openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt
+openssl genrsa -out ca.key 2048
+openssl req -new -x509 -days 365 -key ca.key -subj "/C=CN/ST=GD/L=SZ/O=Acme, Inc./CN=Acme Root CA" -out ca.crt
+
+# server certificate (for multiple domains, change subjectAltName to: DNS:example.com,DNS:www.example.com)
+openssl req -newkey rsa:2048 -nodes -keyout server.key -subj "/C=CN/ST=GD/L=SZ/O=Acme, Inc./CN=localhost" -out server.csr
+openssl x509 -req -extfile <(printf "subjectAltName=DNS:localhost") -days 365 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt
+
 # client certificate (the p12/pem format may be useful for some clients)
-openssl req -newkey rsa:2048 -nodes -keyout client.key -out client.csr
-openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 02 -out client.crt
+openssl req -newkey rsa:2048 -nodes -keyout client.key -subj "/C=CN/ST=GD/L=SZ/O=Acme, Inc./CN=client" -out client.csr
+openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt
 openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12
 openssl pkcs12 -in client.p12 -out client.pem -clcerts
 ```