# Include SANs in SSL CRT

**URL:** <https://forum.inductiveautomation.com/t/include-sans-in-ssl-crt/25508>\
**Category:** Ignition\
**Created:** [June 3, 2019, 3:57pm UTC](https://forum.inductiveautomation.com/t/include-sans-in-ssl-crt/25508 "2019-06-03T15:57:18Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![theerthraj.munusamy](https://avatars.discourse-cdn.com/v4/letter/t/45deac/32.png) [@theerthraj.munusamy](https://forum.inductiveautomation.com/u/theerthraj.munusamy)\
**Post date:** [June 3, 2019, 3:57pm UTC](https://forum.inductiveautomation.com/t/include-sans-in-ssl-crt/25508/1 "2019-06-03T15:57:18Z")

</div>

Hi,

I want to generate a SSL certificate with SANs. When I try “keytool -certreq -alias tomcat -file C:\csr.txt -keystore C:\ssl.key -ext [SAN=test.testdomain.com](http://SAN=test.testdomain.com)” I get an error saying ‘illegal operation: -ext’.

Thanks

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [June 3, 2019, 4:08pm UTC](https://forum.inductiveautomation.com/t/include-sans-in-ssl-crt/25508/2 "2019-06-03T16:08:14Z")

</div>

Try putting the `-ext` argument _before_ the `C:\ssl.key` filepath - the argument parsing likely doesn’t expect arguments after the output file.

---

<div class="post-metadata">

**Author:** ![theerthraj.munusamy](https://avatars.discourse-cdn.com/v4/letter/t/45deac/32.png) [@theerthraj.munusamy](https://forum.inductiveautomation.com/u/theerthraj.munusamy)\
**Post date:** [June 4, 2019, 9:20am UTC](https://forum.inductiveautomation.com/t/include-sans-in-ssl-crt/25508/5 "2019-06-04T09:20:44Z")

</div>

Tried it. I get the same error. I could not find -ext in help as well. Is this something related to Java version?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [June 4, 2019, 11:45am UTC](https://forum.inductiveautomation.com/t/include-sans-in-ssl-crt/25508/6 "2019-06-04T11:45:28Z")

</div>

You say you want to generate a new certificate but it looks like you’re running a command to generate a CSR…

---

<div class="post-metadata">

**Author:** ![theerthraj.munusamy](https://avatars.discourse-cdn.com/v4/letter/t/45deac/32.png) [@theerthraj.munusamy](https://forum.inductiveautomation.com/u/theerthraj.munusamy)\
**Post date:** [June 4, 2019, 11:58am UTC](https://forum.inductiveautomation.com/t/include-sans-in-ssl-crt/25508/7 "2019-06-04T11:58:37Z")

</div>

Sorry, I meant CSR not CRT.

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [June 4, 2019, 12:04pm UTC](https://forum.inductiveautomation.com/t/include-sans-in-ssl-crt/25508/8 "2019-06-04T12:04:57Z")

</div>

The SAN needs to be part of the certificate before you generate a CSR for it.

Try generating a new certificate, using `-ext SAN=...` to put your desired hostname into it, then generate a CSR without that sub-command.