0

The server that this is for will operate in a intranet environment...

I have Apache working with SSL. I am using a self-signed SSL Certificate created using the steps outlined here: http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#realcert under the How do I create and use my own Certificate Authority (CA) section. When I create the certificate, I use the domain in CommonName field so when I access https://mysite.com after installing the certificate in the web browser, everything is smooth... When I try to use the server by IP address, I receive the following type of error (IE) even though my certificate for the domain name is already installed in the web browser:

enter image description here

I would like the site to be accessible by IP address too without having the web browser have a fit (https://1.2.3.4). Is it possible to have a setup where using the IP address of the server or domain for https will work??? I need this setup because some people access the server by IP and some use the domain name.

UPDATE: I Tried using 'Subject Alternative Names' and it worked great, but this feature is due to expire Nov. 1, 2015...So, DON'T USE IT!!!. Here is some follow up documentation on the subject:

https://www.digicert.com/internal-names.htm

https://cabforum.org/wp-content/uploads/Guidance-Deprecated-Internal-Names.pdf

Here is a 'blurb' from the above .pdf on the subject:

Also as of the Effective Date, the CA SHALL NOT issue a certificate with an Expiry Date later than 1 November 2015 with a SAN or Subject Common Name field containing a Reserved IP Address or Internal Server Name.

Bummer, had it all working great but ran into this brick wall after creating a certificate that is good for 10 yrs and seeing that the web browsers wouldn't except it. Anyhow, looking for a work-a-round if there is one...

|improve this question
1

AFAIK, you need to use the same domain as the cert is registered with when accessing a site. So the IP address will always fail on the certificate check by the browser, since the IP is not part of the Certificate.

|improve this answer
  • There must be a way to do what I'm looking for..I just found a post on SNI that looks promising...unix.stackexchange.com/questions/128370/… – GoinOff Apr 14 '15 at 18:13
  • 1
    A certificate can cover multiple names ("Subject Alternative Names"), and my vague memory is that they have the form DNS:www.foo.example in the config, so I guess there's a syntax to have naked IPs in there, too. – Ulrich Schwarz Apr 14 '15 at 18:21
  • @ulrich, it works now. If you would like to post an answer, I'll upvote it and approve as official answer. Also, this document was helpful apetec.com/support/GenerateSAN-CSR.htm – GoinOff Apr 14 '15 at 22:02
  • @GoinOff Glad you found a way - I will have to take a look at that as well. Could come in handy someday. – Caja Apr 15 '15 at 12:48
1

Your browser will try and match the Subject field of the cert with the HTTP Host Header.

AFAIK, you cannot connect to an IP in this manner and expect the SSL certificate to verify ok. (I could be wrong)

Additionally, you are using Self Signed SSL certs. Unless you import the CA cert into your browser as a Trusted CA you are always going to get warnings.

A useful openssl command to look at a remote SSL certificate is (e.g.):

openssl s_client -connect www.example.com:443

Or in your case : openssl s_client -connect remote IP:443

This might assist in debugging.

|improve this answer
  • My goal was to have users install the certificate one time as a trusted CA and have it be good by hostname or IP address on an intranet. Why?? because some of our customers don't use DNS or configure hostnames on our servers and only use IP This is why I was trying to cover both hostname and IP..Thx for the debugging tips. – GoinOff Apr 23 '15 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.