Generate a CSR that marks the extension as critical: ``` openssl req -new -sha256 -key domain.key -subj "/" \ -reqexts SAN -config <(cat /etc/ssl/openssl.cnf \ <(printf "[SAN]\nsubjectAltName=critical,DNS:foo.com,DNS:www.foo.com")) ``` When pressing "Validate CSR", the following error appears: ``` Error: Failed validating CSR ``` Please, see https://www.openssl.org/docs/manmaster/apps/x509v3_config.html