title: Java Keytool stripping away SAN on CSR generation
body: <p>Using the <code>keytool</code> included with JDK 7, I am creating a keystore including a certificate with a SAN extension.  If decode the certificate, I see the SAN extension.  If I then use <code>keytool</code> to export a CSR, the SAN information is missing from the CSR.</p>
  
  <p>What gives?</p>
  
  <p><strong>Update</strong>:
  I've learned that if I want to include a SAN in the CSR I need to explicitly indicate the SAN in the command lie so:</p>
  
  <p><code>keytool -certreq -alias mycertificate -keystore mekeystore.jks -ext san=dns:mydomain.com</code></p>
  
  <p>That said, I've punted on using the SAN as signing the CSR with my OpenSSL CA is needlessly complicated.</p>