add san to certificates

generate-certificates.sh

@@ -1,23 +1,38 @@
 #!/usr/bin/env bash
 
-[ -d ssl ] || mkdir ssl
+sudo rm -rf ./ssl ; mkdir ssl
 cd ssl
 
-hostname=$(hostname)
 lgtm_ssl=/home/vst/lgtm-stack/ssl
+scart=$lgtm_ssl/ca.crt
+hostname=$(hostname)
+subj="/CN=$hostname.stuyckv.local"
+san="subjectAltName=DNS:$hostname.stuyckv.local,DNS:localhost,IP:127.0.0.1"
 function request-certificate {
     type=$1
     scsr=$lgtm_ssl/$hostname.$type.csr
     scrt=$lgtm_ssl/$hostname.$type.crt
 
-    openssl req -new -newkey rsa:2048 -nodes -keyout $type.key -out $type.csr -subj "/CN=$hostname.stuyckv.local"
+    openssl req -new -newkey rsa:2048 \
+        -keyout $type.key -out $type.csr \
+        -nodes  -subj $subj
     scp $type.csr vst@shion.stuyckv.local:$scsr
 
-    ssh vst@shion.stuyckv.local openssl x509 -req -in $scsr -CA $lgtm_ssl/ca.crt -CAkey $lgtm_ssl/ca.key -CAcreateserial -out $scrt -days 365
+    ssh vst@shion.stuyckv.local \
+        "echo '$san' > /tmp/$hostname.san &&
+         openssl x509 -req \
+            -in $scsr -out $scrt -days 365 \
+            -CA $scart -CAkey $lgtm_ssl/ca.key \
+            -CAcreateserial \
+            -extfile /tmp/$hostname.san && \
+         rm /tmp/$hostname.san"
+
     scp vst@shion.stuyckv.local:$scrt $type.crt
     rm $type.csr
+    cat ca.crt >> $type.crt
 }
 
+scp vst@shion.stuyckv.local:$scart ca.crt
 request-certificate client
 request-certificate server
 # openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr -subj "/CN=$(hostname).stuyckv.local"