Sign a server certificate

Signing is the moment your lab CA acts as an authority. The CA signs the CSR after deciding that its requested identity is allowed. In a real CA that decision involves domain validation; in our lab, you are the policy, so the decision is yours — but the mechanics are the same.

Sign the lab request while copying its SAN extension:

openssl x509 -req -in app.csr -CA lab-ca.crt -CAkey lab-ca.key -CAcreateserial -out app.crt -days 14 -sha256 -copy_extensions copy

Walk through the options. -CA and -CAkey identify the signer; you will be prompted for the CA key passphrase. -CAcreateserial generates a serial number file (lab-ca.srl) so each issued certificate gets a unique serial. -days 14 keeps the leaf short-lived. The one that trips people up is -copy_extensions copy: without it, OpenSSL drops the requested extensions, and your certificate comes out with no subjectAltName at all. A useful leaf certificate also needs suitable extensions, not just a signed name.

Now verify the result against the lab root:

openssl verify -CAfile lab-ca.crt app.crt
# app.crt: OK

app.crt: OK means the chain from this leaf to your root validates: the signature checks out, the dates are current, and the issuer is trusted (because you told verify to trust it with -CAfile).

Then inspect SAN, validity, issuer, and basic constraints:

openssl x509 -in app.crt -noout -issuer -dates -ext subjectAltName
# issuer=CN = Practical TLS Lab CA
# notBefore=Aug  3 10:45:00 2026 GMT
# notAfter=Aug 17 10:45:00 2026 GMT
# X509v3 Subject Alternative Name:
#     DNS:app.lab.test, DNS:localhost

If the SAN block is missing, you forgot -copy_extensions copy. Re-sign — the CSR is still valid, so this costs one command. This is the single most common issuance mistake, and the symptom appears much later as a hostname mismatch that makes no sense until you decode the certificate.

Keep lab roots and certificates short-lived. Do not reuse this learning CA for production systems. A production internal CA needs revocation, audited issuance policy, and protected key storage — none of which our two files provide.