A quick question.
I sign a certificate for PKILabServer.com (Listed under Common Name),
open /etc/hosts
and add the following entry 127.0.0.1 PKILabServer.com
Then launch the server using the command % openssl s_server –cert server.pem -www
I point the browser to https://PKILabServer.com:4433 and then it shows "Invalid security certificate..."
and then I load my certificate file ca.crt
and the website loads perfectly.
The question is that, since PKILabServer.com points to the localhost, if we use https://localhost:4433 instead, we will be connecting to the same web server.
But when I point the browser to localhost:4433
, I get an error saying "This certificate is valid only for pkilabserver.com..." I'm required to explain the reason for this in my project, and this is what I answered. Please correct me if I'm wrong.
This is because the Certificate Signing Request that was generated was signed exclusively for PKILabServer.com (as it was listed under Common Name)
Since the /etc/hosts file had entries for a lot of other websites which were listed under localhost, hence pointing the browser to localhost:4433
would take the website listed in the /etc/hosts file and since the websites don’t match, we get the error that “The certificate is only valid for PKILabServer.com”
openssl s_server
for anything except testing in a very narrow scope.CN=PKILabServer.com
is probably wrong. Hostnames always go in the SAN. If its present in the CN, then it must be present in the SAN too (you have to list it twice in this case). For more rules and reasons, see How do you sign Certificate Signing Request with your Certification Authority and How to create a self-signed certificate with openssl?