Can I specify CN as just * for server with dynamic IP from DHCP and no domain name? The point is that address of server is unknown and it's dynamic. Clients search for server in broadcast domain using broadcasts and then they need to connect over DTLS and verify server using certificate signed by internal CA.

This system design is fixed I'm not decisive person. I'm just asking about way to create certificate accepted by OpenSSL library in DTLS, without explicitly specifying address of server. Blind guess was to just use * as CA but I started to worry if OpenSSL is gonna accept such cert.

  • 1
    If you don't need hostname validation in libssl... then just don't enable it when writing your program. It is not a mandatory feature. – grawity Apr 23 '17 at 22:27

Wildcard SSL certificate requires fully qualified domain names (FQDN), so you should request a certificate for *.yourdomain.com. If your DHCP server does not support nameservers, or you requires to apply custom nameservers that are dissimilar than your DHCP server's leases, then you can utilize another DNS yourself.

To enable subdomain isolation, you have to use a valid domain name as your hostname instead of an IP address.





No Wildcard SSL Certificate will work on Dynamic IP address, you must a static IP.

Will you please clear what exactly you are talking about the "Full Wildcard SSL"?, So that I can help you out with another solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.