From 6ce22410a5f50d798a64977a42af7f343bf70a84 Mon Sep 17 00:00:00 2001
From: Vincent Stuyck <me@stuyckv.com>
Date: Sun, 2 Aug 2026 10:24:29 +0000
Subject: [PATCH] add san to certificates

---
 generate-certificates.sh | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/generate-certificates.sh b/generate-certificates.sh
index 69084f9..b0f90b0 100755
--- a/generate-certificates.sh
+++ b/generate-certificates.sh
@@ -1,23 +1,38 @@
 #!/usr/bin/env bash
 
-[ -d ssl ] || mkdir ssl
+sudo rm -rf ./ssl ; mkdir ssl
 cd ssl
 
-hostname=$(hostname)
 lgtm_ssl=/home/vst/lgtm-stack/ssl
+scart=$lgtm_ssl/ca.crt
+hostname=$(hostname)
+subj="/CN=$hostname.stuyckv.local"
+san="subjectAltName=DNS:$hostname.stuyckv.local,DNS:localhost,IP:127.0.0.1"
 function request-certificate {
     type=$1
     scsr=$lgtm_ssl/$hostname.$type.csr
     scrt=$lgtm_ssl/$hostname.$type.crt
 
-    openssl req -new -newkey rsa:2048 -nodes -keyout $type.key -out $type.csr -subj "/CN=$hostname.stuyckv.local"
+    openssl req -new -newkey rsa:2048 \
+        -keyout $type.key -out $type.csr \
+        -nodes  -subj $subj
     scp $type.csr vst@shion.stuyckv.local:$scsr
 
-    ssh vst@shion.stuyckv.local openssl x509 -req -in $scsr -CA $lgtm_ssl/ca.crt -CAkey $lgtm_ssl/ca.key -CAcreateserial -out $scrt -days 365
+    ssh vst@shion.stuyckv.local \
+        "echo '$san' > /tmp/$hostname.san &&
+         openssl x509 -req \
+            -in $scsr -out $scrt -days 365 \
+            -CA $scart -CAkey $lgtm_ssl/ca.key \
+            -CAcreateserial \
+            -extfile /tmp/$hostname.san && \
+         rm /tmp/$hostname.san"
+
     scp vst@shion.stuyckv.local:$scrt $type.crt
     rm $type.csr
+    cat ca.crt >> $type.crt
 }
 
+scp vst@shion.stuyckv.local:$scart ca.crt
 request-certificate client
 request-certificate server
 # openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr -subj "/CN=$(hostname).stuyckv.local"