2

I am currently experimenting with a local server running apache / owncloud. Eventually I want to make it available from the www, but I am not quite there yet... The server is named smallserv.lan, the hostname is resolved by my router which is running dnsmasq on openwrt.

I can reach the server under the adress and everything works find. However, I would like to use SSL (I don't know what my roommates may be up to). I generated a key and a csr via openssl req -new -key server.key -out server.csr. As a common name I entered "*.smallserv.lan". I signed the csr using openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt.

I copied the certificate to my laptop, installed it and attempted to go to "https://smallserv.lan" using firefox.

I ended up getting a This Connection is Untrusted warning claiming that

smallserv.lan uses an invalid security certificate.

The certificate is only valid for *.smallserv.lan

The *.smallserv.lan is a link which points to https://www.smallserv.lan/ The www prefix is something that I find rather confusing. I thought that as a prefix this is reserved for names of servers which are acutually in the www. I can't quite figure out how to get this right, should I choose www.smallserv.lan as a hostname of my local server or is there some way I can convice openssl to cerate the certificate for a local hostname?

Improve this question
4
  • If you are using a self-signed certificate (which you have to be in this context), most of the details don't really matter. Even with i's dotted and t's crossed web browsers will always call it Untrusted anyway because it is by definition. You just agree to make an exception in this case and the actual connection will work fine.
    – goldilocks
    Nov 11 '14 at 19:26
  • Well, you can import the crt file into your system, that means that it is trusted!? I mean I can also add a public ssh key fingerprint to .ssh/known_hosts. Same thing isn't it?
    – hfhc2
    Nov 11 '14 at 19:29
  • Then you run into the hassle of faking a domain as per above. Which is going to be more of a hassle if you want to access the server from some other machine on the LAN. Not only do you have to add the crt, you have to do something with DNS resolution, etc. You don't have a real domain or a backed cert, that's that. You can either tell the browser to its face everything is okay or bend over backward to fool it.
    – goldilocks
    Nov 11 '14 at 19:34
  • The exception would be cases where the browser/system won't let you make an exception for it. I've seen that happen with an Android device (but not all of them) and it is just a PITA to resolve.
    – goldilocks
    Nov 11 '14 at 19:38
1

You should use www.smallserv.lan or some other subdomain. The www prefix isn't reserved for public-facing sites so it's perfectly safe to use it. You can't use smallserv.lan with your wildcard certificate because .smallserv.lan is not the same as smallserv.lan

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.