From 3ce0988f5ac213db3ecd111a7e7452490119a0be Mon Sep 17 00:00:00 2001
From: Jarrod Johnson <jjohnson2@lenovo.com>
Date: Mon, 29 Jun 2026 11:30:49 -0400
Subject: [PATCH] Fix -s on certutil

---
 confluent_server/confluent/certutil.py | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/confluent_server/confluent/certutil.py b/confluent_server/confluent/certutil.py
index 0b3629da..bd2cc2e8 100644
--- a/confluent_server/confluent/certutil.py
+++ b/confluent_server/confluent/certutil.py
@@ -472,11 +472,13 @@ async def main():
             sindex = sys.argv.index('-s')
             subj = sys.argv.pop(sindex + 1)  # Remove subject argument
             sys.argv.pop(sindex)      # Remove -s flag
-            try:
-                ipaddress.ip_address(subj)
-                sans.add('IP:{0}'.format(subj))
-            except ValueError:
-                sans.add('DNS:{0}'.format(subj))
+            subjs = subj.split(',')
+            for subj in subjs:
+                try:
+                    ipaddress.ip_address(subj)
+                    sans.add('IP:{0}'.format(subj))
+                except ValueError:
+                    sans.add('DNS:{0}'.format(subj))
             san = ','.join(sans) if sans else None
         except ValueError:
             pass
@@ -489,6 +491,11 @@ async def main():
         csrout = sys.argv[1]
     except IndexError:
         csrout = None
+    if '-r' in sys.argv:
+        rindex = sys.argv.index('-r')
+        csrout = sys.argv.pop(rindex + 1)  # Remove csrout argument
+        sys.argv.pop(rindex)      # Remove -r flag
+        keyout = None
     await create_certificate(keyout, certout, csrout, subj, san, backdate=False, days=days)
 
 if __name__ == '__main__':