I have a CSR with correct SAN info, the minute I generate a CRT with said csr it strips the SAN info.
openssl x509 -req -in xxx.csr -CA xxx.pem -CAkey xxx.key -CAserial xxx.srl -extensions v3_req -out xxx.crt -days 730 -sha256
SAN is manually added to the openssl.cnf so it inputs it fine into the CSR but will not with the CRT.
This is all self signed.
v3_req has the SAN info for injecting.