Identity Connect CSR missing subjectAlternativeName

Question

I'm setting up Identity Connect so our employees can authenticate against AD and get logged in to SF.

While it mostly works, I don't want the users to see browser warnings about invalid certificates.

From the admin/settings/SSL page in IC, I generated a CSR. However, that CSR is missing the subjectAlternativeName field.

Without that, getting the CSR signed and uploading the cert doesn't do me much good. As of Chrome 58, the SSL cert must have the SAN field or the user gets a big warning page about an invalid cert.

Is there some way to fix this? The IC guide shows how to generate a CSR via command line with keytool, but that seems to only be for Linux.

The only workaround I see so far is to use a GPO to tell Chrome to allow the cert without SAN. But that's just a short-term workaround. I'd prefer a proper fix.

Do I have to wait for Salesforce to fix Identity Connect?

Answer 1

You could just create the CSR through the command line using the ext argument. I'd say this is more of an RFE for the Salesforce / Forgerock guys to include this as an optional attribute on creation.

Create the Keystore: keytool -genkey -alias SANTEST -keyalg RSA -keystore SANTEST.jks -keysize 2048

Issue the CSR: keytool -certreq -alias SANtest01 -keystore SANTEST.jks -ext san=dns:san.yourdomain.com -keysize 204