Incorrect SAN entries presented on signing confirmation about easy-rsa HOT 2 CLOSED

Hi, when signing a csr the confirmation screen shows different SAN entries than the final certificate will contain.

E.g. ./easyrsa --san="ipaddress:127.0.0.1" --san="DNS:localhost.localdomain" sign-req server myCSR

The confirmation screen will show the SAN entries as:

X509v3 Subject Alternative Name:
        ipaddress:127.0.0.1
DNS:localhost.localdomain

Type the word 'yes' to continue(...)

but the final certificate will only have the last one "DNS:localhost.localdomain" within the SAN section.

Acknowledged.

Likely, caused by adding the new $EASYRSA_EXTRA_EXTS to the current $EASYRSA_EXTRA_EXTS:

The only example of such "option addition" in easyrsa.

• Signing validation screen should only show what is left after parsing and what will actually end up in the CRT.

• Providing --san multiple times eihter should work as expected OR it should throw an exception. But it must not appear to work (esp. in the validate screen) and then cause an incorrect certificate to be signed.

• An additional sanity check and warning should be provided when the data from the final certificate differs from the data shown on the validate screen.

Agreed.

• "ipaddress:" should be an accepted alias for "IP:"

Negative.

from easy-rsa.

This seems to be a left-over from some obscure, early incantation of SAN as an easyrsa option.

The idea that a LF, inside an option that easyrsa intends passing to openssl, as a suitable solution to anything is questionable.

What-ever solution is applied, backward compatibility is not possible.

from easy-rsa.