CSR with subjectAltName on OSX

howto.md

Copy /System/Library/OpenSSL/openssl.cnf to a new file.

Add the following at the end:

[ req ]
req_extensions = v3_req

[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]

Then under alt_names list the DNS names, like:

DNS.1=novemberborn.net
DNS.2=www.novemberborn.net

When using openssl req, use the -config option to point at this modified config file. It'll create a CSR with the alternative names.