Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am building a web site with HTTPS. The host has both a DNS name and an IP address and I'd like the SSL certificate(s) to cover both. I've been given a certificate that is signed by a trusted party - but this certificate does not include the DNS name (there's no Subject Alternative Name etc), only the IP address. I also have a CSR used to create this certificate and the private key used with this CSR.

Now, is there a way, given the assets I have, to create a new certificate, valid for both DNS name and IP address, that is trusted via chaining ultimately to the trusted party? In other words, can I somehow use the certificate I have to sign a new trusted certificate? Am I right to suspect such operation would need the private key of the original CA, which I obviously do not have?

BTW, the server I'm setting up is running Ubuntu and nginx. I already have a working setup with a self-signed certificate. I'm using openssl for certificate manipulation.

share|improve this question
    
Not sure if this question belongs on Super User. Maybe security.SE or serverfault or webmasters.SE? –  BenjiWiebe Feb 18 '13 at 13:55

1 Answer 1

up vote 0 down vote accepted

If the certificate you have is authorized for generating certificates (Intermediate certificates should be, client certificates generally aren't), then yes, but it depends on the type of certificates your cert is authorized to generate/sign, http://stackoverflow.com/questions/310003/can-you-put-ssl-on-a-ip-address-or-only-on-a-web-servers-domain-name

Update for more info

You want to make sure you are an intermediate CA to generate certs, to be specific.

share|improve this answer
    
Thanks for your answer! Any hints how to check if my certificate is authorized for generating other certificates? –  rsz Feb 18 '13 at 13:46
    
stackoverflow.com/questions/12092457/…, Anthony Palmer's answer. –  BigHomie Feb 18 '13 at 13:50
    
Suddenly my knowledge of the public key infrastructure and its use in web browsers kinda doubled or tripled :) Thank you very much! –  rsz Feb 18 '13 at 14:00
    
@rsz no problem, don't forget to mark as answer if this was what you were looking for! –  BigHomie Feb 18 '13 at 14:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.