@@ -269,11 +269,7 @@ public final class GenerateCert {
269269 }
270270
271271 // Try to add SAN, but ignore failure (no logging)
272- do {
273- try addSubjectAltName_IP_simple ( cert: cert, ipString: " 127.0.0.1 " )
274- } catch {
275- // intentionally ignored
276- }
272+ try addSubjectAltName_IP ( cert: cert, ip: " 127.0.0.1 " )
277273
278274 if let ext_bc = X509V3_EXT_conf_nid ( nil , nil , NID_basic_constraints, " CA:FALSE " ) {
279275 defer { X509_EXTENSION_free ( ext_bc) }
@@ -322,24 +318,36 @@ public final class GenerateCert {
322318 }
323319
324320 // Simpler version that doesn't use deprecated stack functions
325- private static func addSubjectAltName_IP_simple( cert: OpaquePointer ? , ipString: String ) throws {
326- guard let cert = cert else {
327- throw CertGenError . sanCreationFailed ( " cert nil " )
328- }
329-
330- // Create SAN string in format "IP:127.0.0.1"
331- let sanString = " IP: \( ipString) "
332-
333- guard let ext = X509V3_EXT_conf_nid ( nil , nil , NID_subject_alt_name, sanString) else {
334- throw CertGenError . sanCreationFailed ( " X509V3_EXT_conf_nid failed for SAN " )
335- }
336-
337- defer { X509_EXTENSION_free ( ext) }
338-
339- if X509_add_ext ( cert, ext, - 1 ) != 1 {
340- throw CertGenError . sanCreationFailed ( " X509_add_ext failed for SAN " )
341- }
321+ private static func addSubjectAltName_IP( cert: OpaquePointer , ip: String ) throws {
322+ guard let conf = NCONF_new ( nil ) else {
323+ throw CertGenError . sanCreationFailed ( " NCONF_new failed " )
342324 }
325+ defer { NCONF_free ( conf) }
326+
327+ // Create a minimal conf with just the SAN section
328+ let confString = """
329+ [san]
330+ IP.1 = \( ip)
331+ """
332+ if NCONF_load_bio ( conf, BIO_new_mem_buf ( confString, - 1 ) , nil ) <= 0 {
333+ throw CertGenError . sanCreationFailed ( " NCONF_load_bio failed " )
334+ }
335+
336+ var ctx : OpaquePointer ?
337+ X509V3_set_ctx ( & ctx, cert, cert, nil , nil , 0 )
338+ X509V3_set_nconf ( ctx, conf)
339+
340+ guard let ext = X509V3_EXT_nconf_nid ( nil , ctx, NID_subject_alt_name, " san " ) else {
341+ let err = ERR_get_error ( )
342+ let reason = ERR_reason_error_string ( err)
343+ throw CertGenError . sanCreationFailed ( " X509V3_EXT_nconf_nid failed: \( reason ?? " unknown " ) " )
344+ }
345+ defer { X509_EXTENSION_free ( ext) }
346+
347+ guard X509_add_ext ( cert, ext, - 1 ) != 0 else {
348+ throw CertGenError . sanCreationFailed ( " X509_add_ext failed " )
349+ }
350+ }
343351
344352 private static func writePrivateKeyPEM( pkey: OpaquePointer ? , to path: String ) throws {
345353 guard let pkey = pkey else {
0 commit comments