title: Generate client certificate with principal name with OpenSSL
body: <p>I need to generate a client authentication certificate with "NT Principal Name" and "RFC 822 Name" under Subject Alternative Name, similar to this certificate, as shown in macOS keychain access (the obscured field values are AD UPN such as <code>test@domain.com</code>):</p>
  
  <p><img src="https://i.stack.imgur.com/Rd12E.jpg" alt="example certificate with principal name"></p>
  
  <p>I've tried using OpenSSL to generate the client authentication certificate with this command:
  <code>openssl req -x509 -config cert_config -extensions 'my server exts' -nodes -days 365 -newkey rsa:4096 -keyout client.key -out client.crt</code></p>
  
  <p>and this cert_config file:</p>
  
  <pre><code>[ req ]
      prompt             = no
      distinguished_name = my dn
  
  [ my dn ]
              commonName = Test
             countryName = US
            localityName = Anywhere
        organizationName = Test
  organizationalUnitName = Dev
     stateOrProvinceName = CO
            emailAddress = info@test.com
                    name = Test Cert
                 surname = Cert
               givenName = Test
                initials = TC
  
  [ my server exts ]
        extendedKeyUsage = 1.3.6.1.5.5.7.3.2,1.3.6.1.4.1.311.20.2.2
          subjectAltName = otherName:1.3.18.0.2.4.318;UTF8:test@example.com
  </code></pre>
  
  <p>But I'm unable to correct format the subject alternative name to match the example in the image above.  I could not find a definition for "NT Principal Name" or "RFC 822 Name" under Subject Alternative Name in the <a href="https://www.openssl.org/docs/man1.1.0/apps/x509v3_config.html" rel="noreferrer">OpenSSL documentation</a>.  When I look at the certificate produced by the command above in keychain access I see:</p>
  
  <p><a href="https://i.stack.imgur.com/0DhFx.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/0DhFx.jpg" alt="produced client certificate"></a></p>
  
  <p>How do I specify the "NT Principal Name" and "RFC 822 Name" fields under Subject Alternative Name in my client authentication certificate?</p>