Subject Alternative Name missing

[fred214]

I used the follow command to issue a new certificate:

lego --email="[email protected]" \
--domains="db.xxx.org" \
--dns manual \
run

In .lego/certificates/db.xxx.org.crt I can not see the SAN in two certs by using openssl x509
But in lego/certificates/db.xxx.org.json I can download cert according to certUrl, it contains the SAN.
I firstly met this situation, before I use the acme.sh to issue the cert, could some one can explain? Many thanks.

[ldez]

Hello,

Theoretically, the cert must be the same.

I tried locally and I have the SAN:

$ openssl x509 -in acme.wtf.crt -ext subjectAltName
X509v3 Subject Alternative Name: 
    DNS:acme.wtf
-----BEGIN CERTIFICATE-----
MIICiDCCAXCgAwIBAgIIFTXQKj+AAEswDQYJKoZIhvcNAQELBQAwKDEmMCQGA1UE
AxMdUGViYmxlIEludGVybWVkaWF0ZSBDQSAzMmZiZGUwHhcNMjIwMjE0MTY1MDE0
WhcNMjcwMjE0MTY1MDE0WjATMREwDwYDVQQDEwhhY21lLnd0ZjBZMBMGByqGSM49
AgEGCCqGSM49AwEHA0IABNnPyzyQxOsGFukZ+GXPhN0CQlWkRKDYtEuEnYEPP3+u
/ezVonCYEc6NadhgNeCof5dsGiBxQtZLN9f4bpgE5dGjgZUwgZIwDgYDVR0PAQH/
BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8E
AjAAMB0GA1UdDgQWBBQetuCppHjFRL1pDfpn7S1VTyZnCzAfBgNVHSMEGDAWgBTz
DXGj1zwjFDmU1/cprGKeu/vvuzATBgNVHREEDDAKgghhY21lLnd0ZjANBgkqhkiG
9w0BAQsFAAOCAQEAMJXMSRTBpXRaEXV0Q6drvUZfBWOi8Tdbsd0wCQMetfQ0W+op
hSrAlJ6QgQlsHb9pWZUwkYjFB+fV6Elpii9HCjV1LdXH+o5HH06+h5VCok0gjwbn
zmaEPnVpumhTIB4RP2Y+HIKDrFV94sRPb+x7xpF0WCkccBDjpNPbYFNMRBEst2rS
5MQ/0jvpMr1N+95VrCptp1FTSwVga3Lp6Q4PZF2ErGzE8oAIt8sNQucZDvAN9/iu
EuD4IwF/mejebx+ARS89rn7G1SeKwzxQoX2YvGsWEvERZr5oERFgVIY/hLKKkI2b
CDLdKI6e279If0E1DLxovWXpKD0eFpCeFtottw==
-----END CERTIFICATE-----

Can you provide more information?

[fred214]

I re-run the command, this time the file contains three certs and the first leaf cert contains the SAN info. I don't know why last time the file only contains two certs. Thanks for solve my issue.