0

Is it possible to use single self-signed certificate for all local domains, like: blog1.test, shop1.test, shop2.test, so i don't have to add all of these certificates to my Keychain (MacOS), instead i'd like to add just one generic self signed certificate?

Here's my /etc/ssl/openssl.cnf config:

[ san ]
subjectAltName                  = @alt_names

[ alt_names ]
DNS.1                           = localhost
DNS.2                           = domain.test

I generated my self-signed cert this way:

sudo openssl req -extensions san -config /etc/ssl/openssl.cnf -x509 -nodes -newkey rsa:4096 -keyout /private/etc/apache2/server.key -out /private/etc/apache2/server.crt -days 3650 -subj "/C=KZ/ST=Almaty/L=Almaty/O=Companyname/CN=localhost"

But even if i add to SAN more DNS records, it won't work on different domain than "localhost". Is this even possible?

7
  • I don’t see why that wouldn’t work. However, using wildcards may be easier. Do not that you should be using arbitrary TLDs in your local network.
    – Daniel B
    Mar 18, 2018 at 15:08
  • Why it would work? I think Common Name is very important during certificate creation, not? Mar 18, 2018 at 15:10
  • @DanielB, just tested again, it's indeed working. I just have to edit openssl.cnf everytime i want to add more domains, then recreate certificate and re add to my keychain. Mar 18, 2018 at 18:10
  • 1
    It'd be a bit more work for initial setup, but in the long run it'd probably be easier in the long run to create your own CA root, mark that as trusted, then sign individual SSL certs with that. Mar 18, 2018 at 20:44
  • 1
    You build a CA and install that CA's certificate in your keychain as a trust-anchor. Every certificate issued by that CA is then automatically trusted by your browser/computer. Each time you stand up a new service (e.g. blog1.test or shop1.test) you have the CA issue a certificate to that service. That service's certificate will be trusted as the CA's certificate is already in your keystore and trusted. Maybe you need to Google 'Certification Authority' - it's a complex subject if you are doing it right (for production), but for a test environment it's quite simple to do. Mar 19, 2018 at 11:57

0

You must log in to answer this question.

Browse other questions tagged .