0

I am building a web site with HTTPS. The host has both a DNS name and an IP address and I'd like the SSL certificate(s) to cover both. I've been given a certificate that is signed by a trusted party - but this certificate does not include the DNS name (there's no Subject Alternative Name etc), only the IP address. I also have a CSR used to create this certificate and the private key used with this CSR.

Now, is there a way, given the assets I have, to create a new certificate, valid for both DNS name and IP address, that is trusted via chaining ultimately to the trusted party? In other words, can I somehow use the certificate I have to sign a new trusted certificate? Am I right to suspect such operation would need the private key of the original CA, which I obviously do not have?

BTW, the server I'm setting up is running Ubuntu and nginx. I already have a working setup with a self-signed certificate. I'm using openssl for certificate manipulation.

Improve this question
1
  • Not sure if this question belongs on Super User. Maybe security.SE or serverfault or webmasters.SE?
    – BenjiWiebe
    Feb 18, 2013 at 13:55

1 Answer 1

Reset to default
0

If the certificate you have is authorized for generating certificates (Intermediate certificates should be, client certificates generally aren't), then yes, but it depends on the type of certificates your cert is authorized to generate/sign, https://stackoverflow.com/questions/310003/can-you-put-ssl-on-a-ip-address-or-only-on-a-web-servers-domain-name

Update for more info

You want to make sure you are an intermediate CA to generate certs, to be specific.

Improve this answer
4
  • Thanks for your answer! Any hints how to check if my certificate is authorized for generating other certificates?
    – rsz
    Feb 18, 2013 at 13:46
  • stackoverflow.com/questions/12092457/…, Anthony Palmer's answer.
    – MDMoore313
    Feb 18, 2013 at 13:50
  • Suddenly my knowledge of the public key infrastructure and its use in web browsers kinda doubled or tripled :) Thank you very much!
    – rsz
    Feb 18, 2013 at 14:00
  • @rsz no problem, don't forget to mark as answer if this was what you were looking for!
    – MDMoore313
    Feb 18, 2013 at 14:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .